JWT Decoder

What is the JWT Decoder?

The JWT Decoder splits a JSON Web Token into its three segments and decodes the header and payload so you can read the claims. It is a debugging aid for inspecting tokens, it decodes them, it does not verify their signatures.

A JWT is three Base64url-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims, and the signature is computed over the first two segments using a secret or private key.

Because the first two segments are only encoded, not encrypted, anyone holding a token can read its contents. This is by design, JWTs provide integrity, not confidentiality. The signature proves the token has not been altered; it does nothing to hide what is inside.

The practical consequence is that you must never put sensitive data in a JWT payload. Passwords, personal data, and internal identifiers in a token are readable by every party that handles it, including the browser it is stored in.

How to use the JWT Decoder

1. Paste your token. Drop the full token, including both dots, into the input field.
2. Read the decoded header. The header shows the algorithm (alg) and token type (typ), and often a key identifier (kid) telling the server which key to verify with.
3. Read the decoded payload. The payload contains the claims, who the token is about, who issued it, when it expires, and any custom fields the application added.
4. Check the timestamps. The exp and iat claims are Unix timestamps. An exp in the past means the token has expired, which is a common cause of unexpected 401 responses.

Worked examples

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NSIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTcwMDAwMDAwMH0.
signature

Header:
{ "alg": "HS256", "typ": "JWT" }

Payload:
{ "sub": "12345", "name": "John Doe", "iat": 1700000000 }

{ "sub": "12345", "exp": 1700000000 }

exp = 1700000000
     = 14 Nov 2023, 22:13:20 UTC
Status: expired

Common use cases

• Debugging authentication failures. Decoding the token shows immediately whether it has expired, targets the wrong audience, or is missing a claim your API requires.
• Inspecting scopes and roles. Authorisation problems are often a missing scope or role claim rather than a broken token.
• Verifying your own token issuance. After changing how your service mints tokens, decoding one confirms the claims came out as intended.
• Learning how JWTs are structured. Seeing the segments decoded is the clearest way to understand why payload contents are not secret.

Features and limitations

• Decodes header and payload from Base64url, including tokens without padding.
• Renders the decoded JSON with formatting and highlighting.
• Converts iat, exp, and nbf timestamps into readable dates.
• Does not verify signatures. Verification requires the signing secret or public key, and doing it in a browser tool would mean handling that key, so the tool deliberately does not.
• Encrypted tokens (JWE) are not supported; only signed tokens (JWS) can be decoded.

Frequently asked questions