About JWT Decoder
The JWT Decoder lets you decode and inspect JSON Web Tokens (JWT) instantly. Paste any JWT and view the decoded header (algorithm, token type), payload (claims, expiry, issuer, subject, audience), and signature portion — all formatted as readable JSON.
Expiry times (exp) and issued-at times (iat) are converted from Unix timestamps to human-readable date and time. Claims are displayed with clear labels so you can quickly understand the token's purpose and validity period.
This tool does not verify the JWT signature — it only decodes the header and payload. No secret key is required.
All decoding happens entirely in your browser. Your JWT never leaves your device.
JWT Decoder Features
- Splits header, payload, and signature
The three parts of the token are decoded and displayed separately, so you can inspect the algorithm and token type alongside the claims.
- Highlights standard claims
Common registered claims like exp, iat, iss, and sub are recognized and labeled, including a human-readable date for expiry and issued-at timestamps.
- Nothing leaves your browser
Tokens often carry session or identity data. Decoding happens entirely client-side, so pasting a production token here never sends it anywhere.
How to Use JWT Decoder
Paste your JWT token into the input field.
The header and payload are decoded and displayed as formatted JSON.
Expiry (exp) and issued-at (iat) times are shown as human-readable dates.
Review the claims and copy any values you need.
Examples
Practical Uses for JWT Decoder
- Inspect a JWT's claims while debugging a failed authentication flow
- Check when an access token expires before it causes an API error
- Verify the algorithm declared in a token's header during a security review
- Decode a token pasted from browser DevTools or a support ticket
- Confirm the issuer and audience claims match your expected service
- Inspect a refresh token's payload during OAuth debugging
Common Mistakes to Avoid
- Trusting a decoded token's claims without verifying the signature.
- Decoding only reads the payload — it doesn't confirm the token is genuine. Always verify the signature server-side with the correct key before trusting any claim.
- Pasting a live production token into a public online decoder.
- Use a tool that decodes entirely in the browser (like this one) rather than one that sends the token to a server, especially for tokens carrying real session data.
- Assuming a JWT is encrypted because it looks random.
- Standard JWTs are signed, not encrypted — the payload is just Base64URL-encoded and readable by anyone. Use JWE (JSON Web Encryption) if the payload itself needs to stay confidential.
Who Uses the JWT Decoder Tool
- Backend developers debug authentication issues by inspecting JWT claims and expiry without a server round-trip.
- Security engineers review the algorithm and claims of tokens issued by a service during an audit.
- QA engineers verify that a login flow issues tokens with the correct claims and expiry.
- Support engineers decode a customer-provided token to diagnose an authentication error.
- Students learn how JWTs are structured while studying web authentication.
Comparisons
JWT Decoding vs JWT Verification
Decoding a JWT and verifying it are two different operations. Decoding simply reads the Base64URL-encoded header and payload and converts them back to readable JSON — no secret key is needed, and this is exactly what this tool does.
Verification additionally checks the token's signature against a secret or public key to confirm the token hasn't been tampered with and was actually issued by a trusted party. A token can be decoded by anyone, but only someone with the correct key can verify it's authentic — never trust a decoded JWT's claims without verifying its signature server-side first.
Frequently Asked Questions
Is my JWT sent to a server?
No — all decoding happens entirely in your browser using JavaScript. Your token never leaves your device.
Can this verify a JWT signature?
No — signature verification requires the secret key (for HMAC) or the public key (for RSA/ECDSA), which are not available to this tool. It decodes the header and payload only.
What are JWT claims?
Claims are statements about the subject of the token. Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at), and jti (JWT ID). Custom claims are also common.
How do I check if a JWT is expired?
The exp claim contains a Unix timestamp. This tool converts it to a readable date and highlights it if the token is already expired.
What are the three parts of a JWT?
A JWT has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims), and the signature.
What signing algorithms does JWT support?
Common algorithms include HS256, HS384, HS512 (HMAC-SHA), RS256, RS384, RS512 (RSA), and ES256, ES384, ES512 (ECDSA). The algorithm is declared in the header's 'alg' field.
Why shouldn't I trust a decoded JWT without verifying it?
Anyone can create a JWT with any claims they want and Base64URL-encode it to look legitimate. Decoding only shows you what a token claims — verifying its signature against the issuer's key is what confirms those claims are trustworthy.
Can I decode a refresh token the same way as an access token?
Yes — refresh tokens are often also JWTs with the same three-part structure, so they decode the same way. Some systems use opaque (non-JWT) refresh tokens instead, which won't decode into readable JSON.
What does it mean if the exp claim is in the past?
It means the token has expired and should no longer be accepted by a server enforcing expiry. This tool highlights expired tokens so you can quickly confirm expiry-related authentication failures.
Related Tools
Ready to use JWT Decoder?
It's free, runs entirely in your browser, and there's nothing to install or sign up for.
Scroll up & try it now ↑