JWT Decoder

Decode and inspect JSON Web Tokens. View header, payload, and signature without verification to debug authentication issues.

100% client-side No signup Free forever

Header

ALGORITHM & TOKEN TYPE 
{ }

Payload

DATA 
{ }

Signature

VERIFY SIGNATURE

The signature is used to verify the token's authenticity. It cannot be decoded without the secret key.

// reference

Common JWT Claims

iss Issuer - Who created the token
sub Subject - Who the token is about
aud Audience - Who the token is for
exp Expiration - When the token expires
nbf Not Before - When the token becomes valid
iat Issued At - When the token was created
jti JWT ID - Unique identifier for the token
// how to use

How to Use JWT Decoder

  1. Paste your JWT token
  2. The tool automatically decodes the header and payload
  3. View formatted JSON with syntax highlighting
  4. Check token expiration status
  5. Copy the decoded payload for further use
// features

Features

  • Instant JWT decoding
  • Header and payload visualization
  • Expiration status check
  • Timestamp conversion to human dates
  • Syntax highlighted output
  • Common claims reference
  • Copy decoded data
// about

About JWT Decoder

JSON Web Tokens (JWTs) are the standard for authentication in modern applications. When authentication fails or tokens behave unexpectedly, you need to see inside them. Our decoder reveals the complete contents of any JWT for debugging and verification.

JWT Structure Explained

Every JWT contains three base64-encoded parts:

  • Header: Algorithm used (HS256, RS256, etc.) and token type
  • Payload: Claims including user ID, roles, expiration time
  • Signature: Cryptographic signature verifying token integrity

Common Claims Decoded

The decoder explains standard claims: iss (issuer), sub (subject/user ID), aud (audience), exp (expiration timestamp), iat (issued at), nbf (not before). Expiration times are converted to human-readable dates.

Debugging Authentication Issues

When users report "session expired" errors, check the token's exp claim. If access is denied, examine the roles or permissions claims. Token rejected? Verify the iss and aud match your application's expectations.

Security Note

This decoder reveals token contents without verifying the signature. In production, always verify signatures server-side before trusting token claims. Decoding without verification is only appropriate for debugging—never for access control decisions.

// faq

Frequently Asked Questions

What is a JWT and what does it contain?
JWT (JSON Web Token) is a compact token format containing three parts: header (algorithm, type), payload (claims/data), and signature. It's used for authentication and information exchange. Our decoder shows all three parts with explanation of standard claims.
Is it safe to decode JWTs online?
We only decode - not verify signatures, which requires your secret key. The payload is not encrypted, just encoded (base64). Never paste JWTs containing sensitive data into untrusted tools. Our tool runs client-side - nothing is sent to servers. For production, verify signatures server-side.
What are standard JWT claims?
Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), jti (JWT ID). Our decoder identifies and explains these, converting timestamps to readable dates and flagging expired tokens.
Why can I decode a JWT without the secret?
JWTs are signed, not encrypted. The header and payload are simply base64-encoded (readable by anyone). The signature verifies the token hasn't been tampered with, but reading contents doesn't require the secret. Don't put sensitive data in JWT payloads!
What does "invalid signature" mean?
Without verifying the signature (requires secret key), we can't confirm the token is genuine. The token might be valid or forged - only signature verification tells for sure. In production, always verify signatures before trusting token contents.
What JWT algorithms are supported?
Common algorithms: HS256 (HMAC + SHA256, symmetric key), RS256 (RSA + SHA256, asymmetric), ES256 (ECDSA, asymmetric). Our decoder identifies the algorithm from the header. Some algorithms (like "none") indicate security risks - we flag these.