JWT Decoder

What is JWT Decoder?

A JWT decoder splits a JSON Web Token into its three dot-separated parts — header, payload, and signature — and displays the decoded JSON contents of the header and payload segments. JWTs are the dominant standard for stateless authentication in modern web applications, single-page apps, microservices, and mobile backends.

Each JWT consists of a Base64url-encoded header (typically specifying the algorithm and token type), a payload containing claims like user ID, roles, and expiration, and a cryptographic signature that verifies the token was issued by a trusted authority. Decoding reveals the first two parts; signature verification requires the secret key or public certificate.

Developers use JWT decoders daily to debug login failures, inspect expired tokens, verify claim values, and understand third-party identity provider tokens from Auth0, Okta, Firebase, and AWS Cognito. Seeing decoded claims instantly answers questions like 'What user does this token represent?' and 'Has this token expired?'

Our decoder processes tokens entirely in your browser. Access tokens, refresh tokens, and ID tokens containing user PII never leave your device. This is critical during security incident response when tokens from production logs must be inspected without exposing them to external services.

Important security note: decoding reveals token contents but does NOT verify the signature. Anyone can decode a JWT and read its claims. Always use a proper cryptographic library to verify signatures in production. Pair with Base64 Decode for manual segment inspection and JSON Formatter for readable claim output.

When should you use JWT Decoder?

Debug authentication failures when users report 'session expired' or 'unauthorized' errors. Decode the token to check the exp (expiration) claim, iss (issuer), and aud (audience) values against your server's validation rules.

Inspect tokens from OAuth 2.0 and OpenID Connect flows during integration with identity providers. Verify that expected scopes, roles, and custom claims appear in the payload after successful login.

Understand third-party API tokens before implementing authorization logic. Decode sample tokens from documentation or sandbox environments to see which claims carry permissions and user identity.

Audit token contents during security reviews. Confirm that sensitive data is not stored in JWT payloads (which are only encoded, not encrypted) and that expiration times follow your security policy.

How to Use JWT Decoder

1. Paste your JWT token into the input.
2. View decoded header and payload as formatted JSON.
3. Check expiration status and standard claims.
4. Use insights to debug authentication issues.

Features

• Decode JWT header and payload to readable JSON instantly
• Display expiration (exp) claim with human-readable date and status
• Highlight standard registered claims: iss, sub, aud, iat, exp, nbf
• Automatic Base64url decoding of header and payload segments
• Privacy-first — tokens never uploaded to any server
• Works with HS256, RS256, and other common algorithm headers
• Copy decoded JSON for documentation or further analysis
• Clear error messages for malformed or incomplete tokens

Example

This example token uses HS256 (HMAC-SHA256) signing. The header identifies the algorithm and token type. The payload contains a subject ID (sub), display name, and issued-at timestamp (iat). The third segment is the signature, which this tool displays but does not verify. The iat value 1516239022 converts to a specific UTC datetime, helping you confirm when the token was created.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header: {
  "alg": "HS256",
  "typ": "JWT"
}
Payload: {
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Common Errors

Best Practices

• Verify signatures server-side — never trust decoded claims without cryptographic validation
• Decode tokens locally during debugging to protect user credentials and session data
• Check exp, nbf, iss, and aud claims against your validation rules during integration
• Use short-lived access tokens (minutes) with refresh tokens for better security
• Format decoded JSON with the formatter for documentation and team communication
• Rotate signing keys periodically and document the rotation process
• Never log full tokens in production — log only subject IDs or trace identifiers
• Understand the difference between JWS (signed) and JWE (encrypted) tokens

Frequently Asked Questions