JWT Decoder
Decode and inspect JSON Web Tokens (JWT) instantly with header and payload analysis, claim validation, and security-focused design. Perfect for debugging authentication, API development, and security auditing with comprehensive error handling and example tokens.
Complete Guide: JWT Decoder
Everything you need to know about using this tool effectively
The JWT Decoder parses a JSON Web Token and displays its header and payload as formatted JSON. It Base64-decodes the header and payload segments, pretty-prints the JSON, and highlights standard claims like iss, sub, exp, iat, and aud. The tool does not verify the signature. All processing happens in the browser.
This tool splits a JWT string on the period (.) delimiter, Base64-decodes the first segment (header) and second segment (payload), and displays them as formatted JSON. The third segment (signature) is shown but not decoded or verified.
Debugging authentication issues
Decode a JWT from a failed API request to inspect the claims and expiration.
Inspecting token contents
View the user ID, roles, and permissions encoded in a JWT.
Checking token expiration
Verify whether a JWT has expired by checking the exp claim.
Learning JWT structure
Understand how JWTs are structured with header, payload, and signature segments.
Paste the JWT
Enter the complete JWT string (three Base64 segments separated by periods).
Decode
Click Decode. The tool shows the header and payload as formatted JSON.
Inspect the claims
Review the decoded claims including expiration, issuer, and subject.
JWTs have three segments separated by periods: header.payload.signature.
The exp claim is a Unix timestamp. The tool converts it to a readable date.
This tool decodes but does not verify. Use a JWT library for verification in production.
Never share real JWTs with third parties. They grant access to the encoded claims.
What is a JWT?
A JSON Web Token is a compact, URL-safe token format used for authentication and information exchange. It consists of a header, payload, and signature, each Base64-encoded.
Does this tool verify the signature?
No. The tool only decodes the header and payload. Signature verification requires the secret key or public key, which this tool does not use.
Is my token sent to a server?
No. All decoding happens in your browser. The token never leaves your device.
What standard claims are highlighted?
iss (issuer), sub (subject), aud (audience), exp (expiration), iat (issued at), nbf (not before), and jti (JWT ID).
Can I decode expired tokens?
Yes. The tool decodes any JWT regardless of its expiration. The exp claim shows when the token expired.