JWT Visualizer Decoder

What Can the JWT Visualizer Do?

The JWT Visualizer Decoder is a pure frontend online tool for real-time decoding and visualizing the three components of a JWT (JSON Web Token): Header, Payload, and Signature. It supports switching between tree view and raw JSON view, automatically identifies algorithm types, parses standard claim fields (iat/exp/nbf/sub) with readable times and expiration status, and supports HS256 signature verification. All decoding is performed locally in your browser—no token data is ever uploaded to any server.

Core Features

• Tree Visualization: Displays JWT Header and Payload as a collapsible hierarchical tree for clear nested structure viewing
• Real-time Decoding: Instant response on input—paste a token and it auto-decodes Base64Url and formats the display
• Algorithm Detection: Automatically identifies HS256/RS256/ES256 and other algorithms with highlighted display
• Expiration Alert: Parses the exp field, calculates and displays "X hours remaining" or "expired X days ago"
• Signature Verification: Enter a secret key to verify HS256 signature correctness

How to Use

Step 1: Paste a JWT Token string (format: xxx.yyy.zzz) in the input box, or click "Load Example" for a demo.

Step 2: Click "Decode" or press Ctrl+Enter to automatically parse Header, Payload, and Signature.

Step 3: Switch between tree view and raw JSON view. Click toggle icons to expand/collapse nested fields.

Step 4: To verify HS256 signatures, enter the secret key in the signature section and click "Verify Signature".

Use Cases

API Debugging

Quickly decode OAuth2/JWT access tokens to view user ID, roles, permissions, and expiration time for authentication troubleshooting.

Security Audit

Check if JWTs use weak algorithms (like none/HS256), verify signature correctness, and discover token leakage risks.

Development Debugging

Compare server-generated JWTs with client-received tokens to troubleshoot encoding/signing issues.

Learning & Understanding

Visually understand JWT composition through tree structure, learning the meaning and purpose of each standard claim.

Technical Background

A JWT consists of three parts joined by .: Header (algorithm and type), Payload (set of claims), and Signature. Base64Url encoding differs from standard Base64 by replacing +/ with -_ and removing padding =. Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), jti (unique ID). RS256 and other asymmetric algorithms are recommended over HS256 due to lower key leakage risk.

FAQ