JWT Decoder
Decode and inspect JSON Web Tokens to view header, payload, and signature details
Introduction
JSON Web Tokens (JWTs) have become the standard way to handle authentication and authorization in modern web applications and APIs. These compact, URL-safe tokens carry encoded information that allows systems to verify user identity and permissions without constantly querying a database. When you log into a web app, the server often generates a JWT containing your user ID, roles, permissions, and other claims. Our JWT Decoder tool lets you instantly inspect any JSON Web Token to see exactly what information it carries, how it is structured, and whether the claims look correct. This tool decodes the three parts of a JWT—the header (which specifies the algorithm and token type), the payload (containing all your claims and data), and the signature (which proves authenticity). Everything runs entirely in your browser with no server uploads, making it safe for development and testing workflows.
Who Should Use This Tool?
- Backend developers implementing authentication systems and debugging authorization failures
- Frontend developers integrating with JWT-based APIs and troubleshooting authentication issues
- Security analysts conducting token analysis and testing authentication implementations
- API developers verifying token generation and validating claim structures
- DevOps engineers debugging authentication problems in deployed applications
How This Tool Works
A JSON Web Token consists of three Base64URL-encoded parts separated by periods: the header, the payload, and the signature. When you paste a JWT into our decoder, the tool validates the three-part format, then decodes each part to reveal the underlying JSON data. The header contains metadata like the cryptographic algorithm used. The payload contains the actual data—both standard registered claims (issuer, subject, expiration time) and custom claims specific to your application. The signature allows verification that the token hasn't been tampered with. Our decoder parses each part, validates the JSON structure, checks for expiration, and converts Unix timestamps into readable dates. All processing happens in your browser with no server communication.
Try JWT Decoder Now
Use the interactive tool below to get instant results
Security Warning
- This tool only decodes JWTs - it does not verify signatures
- Never paste tokens with sensitive data into untrusted tools
- All processing happens in your browser - no data is sent to any server
- Do not use this tool to validate tokens in production applications
- Decoded tokens may contain sensitive information - handle with care
Quick Reference
Standard Claims:
iss- Issuer (who issued the token)sub- Subject (who the token is about)aud- Audience (who should accept the token)exp- Expiration time (when token expires)nbf- Not Before (when token becomes valid)iat- Issued At (when token was created)jti- JWT ID (unique identifier)
Common Algorithms:
HS256- HMAC with SHA-256HS384- HMAC with SHA-384HS512- HMAC with SHA-512RS256- RSA with SHA-256RS384- RSA with SHA-384RS512- RSA with SHA-512ES256- ECDSA with SHA-256
How to Use Jwt Decoder
Paste Your Token
Copy your JWT token and paste it in the box. A JWT has three parts separated by dots: header.payload.signature. Works with tokens from Auth0, Firebase, AWS Cognito, or any JWT system. Hit Load Sample if you want to see an example first.
Hit Decode
Click the Decode JWT button. The tool checks if the format is valid, decodes the Base64URL parts, and shows you the readable JSON. If something is wrong with the format, you will get an error explaining what needs fixing.
Read the Contents
Check the header (algorithm and token type), the payload (all your claims and data), and the signature (shown encoded). Standard claims like issuer, expiration, and subject get highlighted with explanations. Custom claims show up in their own section.
Check Expiration and Copy
See if the token is expired or still valid, plus how much time is left. Use the copy buttons to grab the header, payload, or signature if you need them for testing or docs. Timestamps get converted to readable dates automatically.
Use Cases for Jwt Decoder
Debugging Authentication
Login API returns a JWT and authentication is not working? Decode the token to check if the user ID, roles, permissions, and expiration look right. Often the issue is an expired token or missing claims.
Testing API Integration
Integrating with an API that uses JWTs? Decode tokens before and after API calls to make sure claims are getting passed through correctly and nothing is getting stripped out or modified unexpectedly.
Security Analysis
Checking JWT security? Look at the algorithm (avoid 'none'), verify expiration claims exist, and inspect what data is in the payload. Useful for security reviews or penetration testing.
Learning How JWTs Work
Trying to understand JWTs? Decode some real examples to see the three-part structure, learn what standard claims mean (iss, sub, exp, aud), and understand how Base64URL encoding works.
Troubleshooting Token Issues
Token not working in production? Decode it to verify the issuer and audience match what your system expects, check the expiration date, and make sure custom claims have the right values. Catches config mistakes fast.
Key Features
Instant Decode
Decodes JWTs instantly with format validation
Pretty JSON
Formatted JSON output with syntax highlighting
Standard Claims Explained
Standard claims like iss, sub, exp shown separately with explanations
Custom Claims
Your custom claims in their own section
Expiration Check
Shows if token is expired and how much time is left
Readable Dates
Timestamps converted to human-readable dates
Copy Buttons
Copy header, payload, or signature with one click
Raw View
See the raw Base64URL-encoded parts if needed
Sample JWT
Load a sample token to see how it works
Error Help
Clear error messages if token format is invalid
Privacy Note
Security disclaimer and privacy notice included
Decode Only
Does not verify signatures (inspection only)
Frequently Asked Questions
What is a JSON Web Token (JWT)?
A JWT is a way to securely pass information between systems as a compact token. It has three parts separated by dots: header (metadata like the algorithm), payload (the actual data and claims), and signature (proves it has not been tampered with). Each part is Base64URL-encoded. JWTs are commonly used for authentication in web apps and APIs because they are small and easy to verify.
Does this tool verify JWT signatures?
Nope. This tool only decodes JWTs so you can read what is inside. Signature verification needs the secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms), and those should never be pasted into any online tool. If you need to verify a signature, use a proper JWT library in your backend code where you have secure access to the keys.
Is it safe to decode tokens here?
Yes, everything runs in your browser. The token never gets sent to any server. But as a general security rule: do not paste production tokens with sensitive data into any online tool, even client-side ones. For production tokens, use a local JWT decoder or a library in your dev environment instead.
What are the standard JWT claims?
Standard claims are optional but common: iss (issuer - who made the token), sub (subject - who it is about), aud (audience - who should accept it), exp (expiration time), nbf (not before - when it becomes valid), iat (issued at - creation time), jti (unique ID). These help different systems understand tokens the same way.
Why will not my JWT decode?
Check these: (1) JWT must have exactly three parts separated by dots, (2) each part must be valid Base64URL, (3) header and payload must be valid JSON, (4) make sure you copied the whole token without cutting any characters off. The error message will tell you which part is broken.