JWT Decoder

What this JWT decoder does

A JSON Web Token (JWT) looks like a long random string, but its first two parts are just Base64url-encoded JSON. This decoder splits the token, decodes the header and the payload, and shows both as formatted JSON so you can read the algorithm, the claims and the expiry time. The token is decoded in your browser and is never sent to our server.

Important: this tool does not verify the signature. It shows what a token says, not whether it is genuine. It is meant for developers, QA engineers and security learners who need to inspect tokens while building or debugging authentication.

How to decode a JWT

1. Copy the token, for example from an Authorization: Bearer … header in your browser's developer tools or from your application logs. Copy only the token, without the word "Bearer".
2. Paste it into the JWT box.
3. Click Submit.
4. Read the Header and Payload sections, shown as indented JSON.

If you see an "Invalid" message, the text is not a well-formed JWT, or one of the first two parts is not valid Base64url-encoded JSON.

The structure of a JWT

JWTs are defined in RFC 7519. A signed JWT has three parts separated by dots: header.payload.signature.

• Header – describes the token, usually the signing algorithm (alg, for example HS256 or RS256) and the type (typ: "JWT"). It may also include kid, the ID of the key used to sign it.
• Payload – the claims: statements about the user or session.
• Signature – created from the header and payload with a secret or private key. Only a server that has the right key can verify it.

Base64url is a URL-safe version of Base64 that uses - and _ instead of + and / and usually omits padding.

How to read the payload

RFC 7519 defines a set of registered claim names. You will see many of them in real tokens:

• iss (issuer) – who created the token, such as your identity provider.
• sub (subject) – who the token is about, usually a user ID.
• aud (audience) – who the token is intended for, such as your API.
• exp (expiration time) – when the token stops being valid.
• nbf (not before) – the token is not valid before this time.
• iat (issued at) – when the token was created.
• jti (JWT ID) – a unique identifier for the token.

Time claims such as exp, nbf and iat are numbers of seconds since 1 January 1970 UTC (Unix time). For example, "exp": 1700003600 means 14 November 2023, 23:13:20 UTC. Paste the number into the Unix Timestamp Converter to see it as a date in your time zone.

Anything else in the payload, such as name, email, roles or scope, is a custom or provider-specific claim.

Common use cases

• Checking why an API returns 401 Unauthorized: is the token expired, or issued for a different audience?
• Confirming which roles, scopes or permissions a token carries.
• Comparing tokens from staging and production identity providers.
• Learning how OAuth 2.0 and OpenID Connect tokens are structured.

Tips and security notes

• Decoding is not verifying. Anyone can create a token with any payload. Your server must always verify the signature with the correct key and check exp, aud and iss using a well-maintained JWT library.
• JWT payloads are readable by anyone. A standard signed JWT is encoded, not encrypted. Do not put passwords or sensitive personal data in it.
• Treat live tokens like passwords. A valid token can give access to an account until it expires. Prefer test tokens or tokens that have already expired when sharing screenshots, and never post live tokens in public tickets or chats.
• Watch the clock. If a token seems expired too early, compare exp with the server time; clock differences between systems are a common cause.
• Encrypted tokens are different. A JWE (encrypted JWT) has five parts and its payload cannot be read without the key.

Frequently asked questions

Is it safe to paste my JWT here?

The token is decoded in your browser and not sent to our server. Still, treat valid production tokens as secrets and use test or expired tokens when you can.

Does this tool verify the JWT signature?

No. It only decodes the header and payload. Signature verification needs the secret or public key and should happen on your server.

Can a JWT be decoded without the secret?

Yes. The header and payload are only Base64url-encoded, so anyone can read them. The secret is needed to create or verify the signature, not to read the content.

How do I check when a JWT expires?

Look for the exp claim in the payload and convert the number from Unix time to a date with the Unix Timestamp Converter.

What is the difference between HS256 and RS256?

HS256 uses HMAC with SHA-256 and a shared secret. RS256 uses an RSA private key to sign and the matching public key to verify, so services can verify tokens without holding the signing key.

Why does my token show as invalid?

It may be truncated, include the "Bearer " prefix or extra quotes, or be an encrypted token whose payload is not readable JSON.

Related tools

• Unix Timestamp Converter – turn exp, iat and nbf values into readable dates.
• Base64 Encode / Decode – encode and decode Base64 text.
• JSON Formatter – pretty-print or minify JSON.
• SHA Hash Generator – create SHA-256 and SHA-512 hashes.