JWT Decoder

What is the JWT Decoder?

A JSON Web Token (JWT, RFC 7519) is a compact string used to carry claims between parties, most often as a bearer token for API authentication. It has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims such as the subject and expiry) and the signature.

Decoding a JWT is simply reversing the Base64URL encoding; no secret is needed, which also means the payload is readable by anyone who holds the token. Never place passwords or sensitive personal data in a JWT. Decoding does not prove a token is genuine: only verifying the signature with the correct key does that, and this should always happen on your server.

When to use the JWT Decoder

Decode a token when authentication fails and you need to know why: is the token expired, issued for a different audience, missing a role claim, or signed with an unexpected algorithm? Frontend developers use it to check which user data a login response contains, backend developers to confirm that the right claims are being issued, and security reviewers to look for sensitive data that should not be in a token. Always follow decoding with proper signature verification in the service that trusts the token.

How to use the JWT Decoder

1. Paste the full token (three parts separated by dots) into the input box.
2. The header and payload are decoded and shown as formatted JSON.
3. Check the exp, iat and nbf claims, displayed as readable dates, to see if the token has expired.
4. Note the alg value in the header, for example HS256 or RS256.
5. Use the information to debug authentication problems; verify the signature in your backend.

Examples

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYiLCJuYW1lIjoiQWRhIiwiZXhwIjoxNzk4NzYxNjAwfQ.signature

Header:   { "alg": "HS256", "typ": "JWT" }
Payload:  { "sub": "123456", "name": "Ada", "exp": 1798761600 }
exp:      2027-01-01 00:00:00 UTC

Common errors and tips

• Token expired: compare exp (seconds since epoch, not milliseconds) with the current time, and allow for small clock skew between servers.
• Invalid token format usually means a missing part or a stray "Bearer " prefix copied with the token.
• Reject tokens with alg: none on your server; always enforce the expected algorithm.
• Keep payloads small: tokens are sent with every request.
• Treat real production tokens as passwords; avoid pasting them into tools that upload data.

Privacy: runs entirely in your browser

This is especially important for tokens: decoding happens entirely in your browser, and your JWT is never transmitted, logged or stored. This tool runs entirely in your browser: nothing you enter is uploaded, stored or logged on our servers, and it keeps working even if you go offline after the page has loaded.