JWT Decoder
Decode JSON Web Token headers, payloads, and claims locally in your browser sandbox.
About JSON Web Token (JWT) Decoding
SuperUtility offers an offline-first JWT Decoder tool designed for developers and security engineers. JSON Web Tokens (JWT) are an open, industry-standard RFC 7519 method for representing claims securely between two parties.
A standard JWT consists of three parts separated by dots (`.`): a Header (specifying algorithm and token type), a Payload (containing claims like subject, expiration, and custom user metadata), and a Cryptographic Signature. Our tool reads this string, translates it instantly from Base64URL encoding, formats the resulting JSON structures, and auto-converts timestamp numbers (like standard claims `exp` and `iat`) into your local timezone dates.
Frequently Asked Questions
Is my JWT token shared with any external servers?
Never. SuperUtility runs 100% client-side inside your web browser. The decoding logic happens locally in your device's Javascript engine. No network packets are sent, making it completely secure for decoding sensitive staging tokens.
What are standard claim keywords inside JWTs?
Common claims include: sub (Subject, usually user ID), iss (Issuer who created the token), aud (Audience for whom it is intended), exp (Expiration Unix epoch time), and iat (Issued-At Unix epoch time).
Can this tool verify the signature of my token?
Signature validation requires providing your HMAC shared secret or RSA public key. To guarantee 100% local safety and prevent server secrets from ever traversing the web, this tool operates purely as a local structure decoder.
Why does it show "Invalid base64 encoding"?
This error occurs when the JWT string contains illegal characters, is missing dot separators, or is missing correct padding characters required for standard Base64URL format conversions.
JWT Format & Claims Structure Example
JWT Encoded Structure
The raw token is a dot-separated string:
[header_base64url].[payload_base64url].[signature_base64url] Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 .eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9 .dYt5WjJrt04h256m082K_358sLh
JWT Decoded Claims Output
The result formatted as clean JSON key-values:
// Decoded Header:
{
"alg": "HS256",
"typ": "JWT"
}
// Decoded Payload Claims:
{
"sub": "1234567890",
"name": "John Doe",
"admin": true
}