How to use the JWT Decoder
1. Paste your JWT token into the text area. A JWT looks like: xxxxx.yyyyy.zzzzz.
2. The header (algorithm & token type) and payload (claims) are decoded and displayed instantly.
3. Copy individual sections using the copy buttons.
4. Note: This tool only decodes JWTs — it does not verify the signature.
What is it?
JSON Web Tokens (JWT) are a compact, URL-safe way to represent claims between two parties. They are widely used for authentication (bearer tokens) and information exchange in APIs.
A JWT has three Base64URL-encoded parts separated by dots: the header (contains the algorithm, e.g., HS256), the payload (contains claims like sub, iat, exp), and the signature (used to verify the token, requires the secret key).
Common payload claims: sub (subject/user ID), iat (issued at), exp (expiry time), aud (audience), iss (issuer). Never store sensitive data in a JWT payload — it is only encoded, not encrypted.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header:
{
"alg": "HS256",
"typ": "JWT"
}
Payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}The signature (third part) is not verified — verification requires the secret key which never leaves your server.
Benefits
Read claims inside a JWT without writing code
See user ID, expiry, roles, issued-at, and custom claims in readable JSON format — no library, no terminal session.
Debug authentication failures by inspecting the token
Expired tokens, wrong audience claims, missing scopes, and incorrect issuer are all immediately visible in the decoded payload.
Verify the algorithm in the header before trusting a token
Check whether a token uses HS256, RS256, or — dangerously — 'none' before accepting it in your application.
Compare tokens across environments to detect drift
Decode tokens from dev, staging, and production to confirm claims, expiry settings, and configuration match expectations.
Frequently asked questions
Does this tool verify the JWT signature?
No. Signature verification requires the secret key or public key. This tool only decodes the Base64URL-encoded header and payload for inspection.
Is it safe to paste my JWT here?
Processing is 100% client-side — your token never leaves your browser. However, be careful with production tokens as they grant access to systems.
What does 'expired' mean?
The 'exp' claim contains a Unix timestamp. If the current time is past this timestamp, the token is expired and most servers will reject it.
What is the difference between JWT and session cookies?
JWTs are stateless — the server doesn't need to store them. Session cookies require server-side storage. JWTs are self-contained and verifiable without a database lookup.
Can I use this for JWE (encrypted JWT)?
No. JWE tokens are encrypted (5 parts) and cannot be decoded without the private key. This tool only works with standard signed JWTs (3 parts).