Interactive visualizer
JWT Visualizer — See Every Claim in a JSON Web Token
Paste a JSON Web Token to see the header, payload, and signature broken out side-by-side. Every registered claim is annotated with its RFC 7519 meaning, and expiration status is computed live from your clock.
Last updated:
Token is EXPIRED
exp was 365d ago (2025-07-20T08:00:00.000Z).
Header
| Claim | Value | Meaning |
|---|---|---|
algAlgorithm | HS256 | Signature/MAC algorithm used to sign the token. |
typType | JWT | Media type of this token, typically "JWT". |
kidKey ID | key-2026-07 | Hint indicating which key was used to sign the token. |
Payload
| Claim | Value | Meaning |
|---|---|---|
subSubject | 1234567890 | Principal the token is about (usually a user id). |
name | Ada Lovelace | Custom / private claim. |
role | admin | Custom / private claim. |
iatIssued At | 17529120002025-07-19T08:00:00.000Z | Unix seconds at which the token was issued. |
expExpiration Time | 17529984002025-07-20T08:00:00.000Z | Unix seconds after which the token MUST be rejected. |
Signature
The signature is HMAC / RSA / ECDSA over base64url(header) + "." + base64url(payload). This visualizer does not verify it — verification requires the signing secret or public key.
What a JWT looks like
A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. The header names the algorithm (typically HS256, RS256, or ES256). The payload is a JSON object of claims. The signature covers the first two segments, and verifying it proves the token has not been tampered with — but decoding does not require the key.
Registered claims explained
- ▸iss — issuer of the token (usually a URL or service identifier).
- ▸sub — subject the token is about (typically a user id).
- ▸aud — audience(s) the token is intended for.
- ▸exp — expiration time in Unix seconds; the token MUST be rejected after this instant.
- ▸nbf — 'not before' time in Unix seconds; the token MUST be rejected before this instant.
- ▸iat — issued-at time in Unix seconds.
- ▸jti — unique JWT identifier, useful for revocation lists.
Security notes
- ▸This visualizer does NOT verify the signature — verification requires the signing key.
- ▸Never paste production tokens into any online tool without understanding what it does.
- ▸'alg: none' tokens are unsigned and MUST be rejected by verifiers in real systems.
- ▸Symmetric algorithms (HS256/384/512) require both sides to share the same secret; asymmetric ones (RS256, ES256) separate signing from verifying.
Frequently Asked Questions
Is my JWT sent to a server?
No. Decoding runs entirely in your browser via atob() and TextDecoder. The token, its claims, and any secrets you paste never leave your device.
Can this tool verify a JWT signature?
This visualizer is decoder-only. For signature verification you need the signing key or public key — and both should be handled server-side or in a trusted local script, never on a random web page.
What does the 'Token is expired' banner mean?
We compare the exp claim to your local clock (Date.now()). If your machine's clock is skewed relative to the issuer, the banner may report a different status than the server would.
How is this different from a JWT decoder tool?
The visualizer is teaching-oriented: it annotates every claim, shows expiration countdowns, and colors the three segments so you can see structure at a glance. Our JWT Decoder tool is the utility form for quick copy/paste debugging.