Decode JWT Tokens — Completely in Your Browser
JSON Web Tokens (JWTs) are ubiquitous in modern authentication systems — every OAuth 2.0 access token, OpenID Connect ID token, and most API authorization tokens are JWTs. When debugging authentication issues, auditing token claims, or understanding what a service's tokens contain, you need to decode them.
Cluster Tools decodes JWTs entirely in JavaScript running in your browser. Your token never leaves your device. This is critical: JWTs encode authentication credentials. Pasting a valid, unexpired JWT into a server-side tool is a real security risk — the server could replay that token against the API it authenticates.
What is a JWT?
A JWT is a compact, self-contained token for transmitting claims (assertions about a subject) between parties. A token looks like:
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiaWF0IjoxNzI2MDE1NjU3fQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
It has three parts separated by dots:
-
Header — metadata about the token: the signing algorithm (
alg) and token type (typ). Base64URL-decoded, it's JSON like{"alg":"RS256","typ":"JWT"}. -
Payload — the claims: the actual data the token asserts. Decoded, it's JSON like
{"sub":"user_123","name":"Alice","email":"alice@example.com","exp":1726015657,"iat":1726012057}. -
Signature — cryptographic proof that the header and payload haven't been tampered with. Created by signing the first two parts with the issuer's private key. Cluster Tools cannot verify this signature without the public key.
Standard JWT Claims Explained
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who issued this token (e.g., https://auth.example.com) |
| sub | Subject | Who the token is about (usually a user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration | Unix timestamp when the token expires |
| iat | Issued At | Unix timestamp when the token was issued |
| nbf | Not Before | Token is invalid before this timestamp |
| jti | JWT ID | A unique identifier for this specific token |
Cluster Tools automatically decodes exp, iat, and nbf from Unix timestamps to human-readable dates, and shows you whether the token is currently expired.
Step-by-Step: How to Decode
- Paste your JWT into the input field above.
- Cluster Tools splits the token at the dots and Base64URL-decodes the header and payload.
- Review the claims — the decoded JSON is formatted and displayed. Timestamps are shown as both Unix epoch and human-readable dates.
- Check expiration — if the
expclaim is in the past, the token is expired and will be flagged.
Important Security Notes
Cluster Tools can decode but not verify JWTs. Decoding only reads the claims — it doesn't verify the signature. A tampered or forged JWT looks identical to a valid one when decoded. Always verify the signature server-side using the issuer's public key before trusting any claims.
Treat JWTs like passwords. A valid, unexpired JWT often grants the same access as a username and password. If a JWT is compromised (leaked to a server-side decoder, included in a bug report, or accidentally logged), revoke it immediately and issue a new one.
Frequently Asked Questions
Can you verify the JWT signature?
Not without the public key. Cluster Tools decodes and displays claims only. Signature verification requires the issuer's public key, which Cluster Tools doesn't have. Use a library like jsonwebtoken (Node.js) or python-jose (Python) to verify signatures in your code.
What's Base64URL vs. Base64?
Base64URL is a URL-safe variant: + becomes -, / becomes _, and padding = is omitted. JWTs use Base64URL for their three components.
Why does the payload show a number for exp?
JWT timestamps are Unix epoch time — the number of seconds since January 1, 1970 UTC. Cluster Tools converts these to readable dates automatically.
Can I create or sign JWTs here? Not currently. JWT signing requires a private key, which you should never paste into a web tool. Sign JWTs server-side using your secure key management system.
Related Tools
- Base64 Encoder/Decoder — decode individual Base64URL components manually.
- JSON Formatter — format the decoded payload JSON for readability.
- URL Encoder/Decoder — decode URL-encoded strings that sometimes appear in token parameters.
- Password Generator — generate cryptographically secure secrets for JWT signing.