Skip to main content

JWT Decoder

Loading…

About JWT Decoder

The JWT Decoder lets you decode and inspect JSON Web Tokens (JWT) instantly. Paste any JWT and view the decoded header (algorithm, token type), payload (claims, expiry, issuer, subject, audience), and signature portion — all formatted as readable JSON.

Expiry times (exp) and issued-at times (iat) are converted from Unix timestamps to human-readable date and time. Claims are displayed with clear labels so you can quickly understand the token's purpose and validity period.

This tool does not verify the JWT signature — it only decodes the header and payload. No secret key is required.

All decoding happens entirely in your browser. Your JWT never leaves your device.

Practical Uses for JWT Decoder

  • Inspect a JWT's claims while debugging a failed authentication flow
  • Check when an access token expires before it causes an API error
  • Verify the algorithm declared in a token's header during a security review
  • Decode a token pasted from browser DevTools or a support ticket
  • Confirm the issuer and audience claims match your expected service
  • Inspect a refresh token's payload during OAuth debugging

How to Use JWT Decoder

  1. Paste your JWT token into the input field.

  2. The header and payload are decoded and displayed as formatted JSON.

  3. Expiry (exp) and issued-at (iat) times are shown as human-readable dates.

  4. Review the claims and copy any values you need.

Examples

Example — Decode a JWT
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Example — Check an expired token's claims
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhYmMxMjMiLCJleHAiOjE1MTYyMzkwMjJ9.dGhpc19pc19hX2Zha2Vfc2lnbmF0dXJl
Output
Payload: {"sub":"abc123","exp":1516239022} — exp is in the past (expired)

Who Uses the JWT Decoder Tool

  • Backend developers debug authentication issues by inspecting JWT claims and expiry without a server round-trip.
  • Security engineers review the algorithm and claims of tokens issued by a service during an audit.
  • QA engineers verify that a login flow issues tokens with the correct claims and expiry.
  • Support engineers decode a customer-provided token to diagnose an authentication error.
  • Students learn how JWTs are structured while studying web authentication.

Comparisons

JWT Decoding vs JWT Verification

Decoding a JWT and verifying it are two different operations. Decoding simply reads the Base64URL-encoded header and payload and converts them back to readable JSON — no secret key is needed, and this is exactly what this tool does.

Verification additionally checks the token's signature against a secret or public key to confirm the token hasn't been tampered with and was actually issued by a trusted party. A token can be decoded by anyone, but only someone with the correct key can verify it's authentic — never trust a decoded JWT's claims without verifying its signature server-side first.

Frequently Asked Questions

Is my JWT sent to a server?

No — all decoding happens entirely in your browser using JavaScript. Your token never leaves your device.

Can this verify a JWT signature?

No — signature verification requires the secret key (for HMAC) or the public key (for RSA/ECDSA), which are not available to this tool. It decodes the header and payload only.

What are JWT claims?

Claims are statements about the subject of the token. Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at), and jti (JWT ID). Custom claims are also common.

How do I check if a JWT is expired?

The exp claim contains a Unix timestamp. This tool converts it to a readable date and highlights it if the token is already expired.

What are the three parts of a JWT?

A JWT has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims), and the signature.

What signing algorithms does JWT support?

Common algorithms include HS256, HS384, HS512 (HMAC-SHA), RS256, RS384, RS512 (RSA), and ES256, ES384, ES512 (ECDSA). The algorithm is declared in the header's 'alg' field.

Why shouldn't I trust a decoded JWT without verifying it?

Anyone can create a JWT with any claims they want and Base64URL-encode it to look legitimate. Decoding only shows you what a token claims — verifying its signature against the issuer's key is what confirms those claims are trustworthy.

Can I decode a refresh token the same way as an access token?

Yes — refresh tokens are often also JWTs with the same three-part structure, so they decode the same way. Some systems use opaque (non-JWT) refresh tokens instead, which won't decode into readable JSON.

What does it mean if the exp claim is in the past?

It means the token has expired and should no longer be accepted by a server enforcing expiry. This tool highlights expired tokens so you can quickly confirm expiry-related authentication failures.