toolverse

JWT Decoder

Decode JWT tokens online. Inspect the header, payload claims, and signature of any JSON Web Token instantly.

What Is a JWT Token?

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519 that represents a set of claims (key-value pairs) as a signed, self-contained token. JWTs are the backbone of modern authentication and authorization systems, used by millions of applications for user login, API access control, single sign-on (SSO), and server-to-server communication.

Every JWT consists of three parts separated by dots:

  1. Header — specifies the token type (JWT) and the signing algorithm (e.g., HS256, RS256, ES256)
  2. Payload — contains the claims: user identity, permissions, expiration time, and any custom data
  3. Signature — a cryptographic signature that verifies the token was issued by a trusted party and has not been modified

A typical JWT looks like this:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Each segment is a Base64URL-encoded JSON object. The header and payload can be decoded by anyone — they are encoded, not encrypted. The signature can only be verified by a party that possesses the signing key.

How It Works

Our JWT decoder performs the following steps entirely in the browser:

  1. Split the token. The JWT is split into its three dot-separated segments.
  2. Decode the header. The first segment is Base64URL-decoded and parsed as JSON, revealing the algorithm and token type.
  3. Decode the payload. The second segment is Base64URL-decoded and parsed as JSON, revealing all claims.
  4. Identify standard claims. Recognized claims like exp (expiration), iat (issued at), nbf (not before), sub (subject), iss (issuer), and aud (audience) are displayed with human-readable labels and formatted timestamps.
  5. Check expiration. If the token has an exp claim, the decoder compares it to the current time and flags expired tokens with a visual indicator.
  6. Display the signature. The raw signature segment is displayed as-is (it is not human-readable without the signing key).

The decoder does not verify the signature. Signature verification requires the secret or public key and is a server-side operation. The decoder is a read-only inspection tool.

Common Use Cases

1. Debugging Authentication During Development

When building or testing an authentication flow, you need to verify that the JWT your server issues contains the correct claims. Paste the token into the decoder to inspect the payload and confirm that user ID, roles, permissions, and expiration are set correctly.

2. Inspecting Third-Party Tokens

When integrating with OAuth providers (Auth0, Firebase, Okta, Cognito), the tokens they issue may contain provider-specific claims. The decoder lets you inspect these tokens to understand what data the provider includes and how to use it in your application.

3. Troubleshooting Authorization Errors

If an API returns a 401 or 403 error despite sending a JWT, the token may be expired, have the wrong audience, or be missing required claims. Decoding the token lets you diagnose the issue without making additional API calls.

4. Verifying Token Expiration

The exp claim is a Unix timestamp that is not human-readable at a glance. The decoder converts it to a formatted date and time, and flags whether the token is currently expired or how long until it expires.

5. Learning About JWT Structure

For developers new to JWTs, the decoder provides a hands-on way to understand the three-part structure, see what claims look like, and experiment with how different inputs produce different encoded tokens.

Tips and Best Practices

  • Decoding is not verification. The decoder reads the token's contents but does not verify the signature. Never treat decoded claims as proof of authenticity — only a server-side verification with the correct key can confirm that.
  • Never paste production tokens into untrusted tools. While our decoder processes everything in the browser, be cautious about pasting JWTs into online tools that may transmit your token to a server. Our tool does not — but verify this claim by checking the network tab in your browser's developer tools.
  • Check all time-based claims. Beyond exp, check nbf (not before) and iat (issued at). A token that is technically not expired may still be invalid if the current time is before nbf.
  • Be aware of sensitive claims. JWT payloads are not encrypted. Anyone with the token can read the claims. If a token contains sensitive information (personal data, internal IDs), be careful about where you paste it.
  • Use short expiration times. If you are the one issuing tokens, keep exp values short (15 minutes for access tokens) and implement refresh token rotation.

FAQ

Does this verify the JWT signature?

No. This tool decodes the header and payload only. Signature verification requires the signing key and appropriate algorithm implementation, which is a server-side operation. The decoder is for inspection and debugging purposes.

Can it decode expired tokens?

Yes. Expired tokens are decoded normally. The decoder displays the token contents and additionally flags the exp claim with an "Expired" indicator so you can see at a glance that the token is no longer valid.

Is my token sent to a server?

No. All decoding happens entirely in your browser using JavaScript. Your JWT is never transmitted over the network. You can verify this by monitoring network requests in your browser's developer tools.

What JWT algorithms are supported?

The decoder works with any JWT regardless of the signing algorithm (HS256, RS256, ES256, PS256, etc.), because it only reads the header and payload — it does not perform any cryptographic operations on the signature.

Why is the signature segment unreadable?

The signature is a binary cryptographic value, not a JSON object. It is Base64URL-encoded for transport, but unlike the header and payload, decoding it does not produce a human-readable structure. The signature can only be meaningfully processed by a cryptographic verification function.

Can it decode JWE (encrypted) tokens?

No. JWE (JSON Web Encryption) tokens have a five-part structure and encrypted payloads that cannot be decoded without the decryption key. This tool handles standard three-part JWS (JSON Web Signature) tokens only.

What are the standard JWT claims?

The registered claims defined by RFC 7519 are: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). The decoder recognizes and labels all of these.