JWT Decoder

Decode & Inspect JSON Web Tokens Instantly

JWT Decoder is a free online tool for decoding, parsing, and inspecting JSON Web Tokens (JWT). Instantly view token header, payload, signature, and claims. Debug authentication and authorization tokens used in OAuth 2.0, OpenID Connect, and modern web applications. Works entirely in your browser with complete privacy - no tokens are ever sent to our servers.

How to Use JWT Decoder

Decoding JWT tokens is simple and instant:

Step 1: Paste Your JWT Token
Paste your complete JWT token into the input field. JWT tokens typically start with 'eyJ' and contain three parts separated by dots (header.payload.signature).
Step 2: Automatic Decoding
The token is automatically decoded and parsed in real-time. No need to click any button - results appear instantly as you paste.
Step 3: Inspect Token Parts
View the decoded header (algorithm, type), payload (claims, expiration, issued-at), and signature. Each part is displayed in formatted JSON for easy reading and debugging.

All JWT decoding and parsing happens locally in your browser using JavaScript. Your tokens never leave your device and are never sent to our servers, ensuring complete privacy and security.

form.title

JWT Token Input

Use Cases

usecases.intro

API Authentication Debugging

When API requests fail due to authentication errors, decode the JWT to check expiration time, issuer, and audience claims to identify the root cause.

Security Audit

Inspect JWTs used in your application to verify that sensitive data isn't exposed in the payload and that appropriate algorithms are being used.

Development & Testing

During development, quickly verify that generated tokens contain the correct claims, roles, and permissions before integration testing.

Token Expiration Analysis

Check the 'exp' and 'iat' claims to understand token validity periods and troubleshoot session timeout issues in your application.

Learning JWT Structure

Students and developers new to JWT can visualize the three-part structure (header, payload, signature) to better understand how token-based authentication works.

What is JWT (JSON Web Token)?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It is compact, URL-safe, and widely used for authentication and information exchange in modern web applications.

Three-Part Structure

A JWT consists of three parts separated by dots: Header (algorithm and token type), Payload (claims and data), and Signature (verification hash). Each part is Base64URL encoded for safe transmission.

Common Use Cases

JWTs are primarily used for authentication (login sessions), authorization (access control), and secure information exchange between services. They're stateless, eliminating the need for server-side session storage.

Security Considerations

While JWTs are signed to prevent tampering, the payload is only encoded, not encrypted. Never store sensitive data like passwords in JWTs. Always verify signatures server-side and use HTTPS for transmission.

Frequently Asked Questions (FAQ)

What is the difference between decoding and verifying a JWT?

Decoding means extracting and reading the header and payload from the token using Base64Url decoding - anyone can do this. Verifying means checking the signature to ensure the token wasn't tampered with - this requires the secret key or public key. Our tool only decodes tokens; signature verification must be done on your secure server.

Is it safe to paste my JWT token here?

Our tool processes tokens entirely in your browser - nothing is sent to servers. However, you should still be cautious with production tokens. For maximum security, only use test/development tokens, or use this tool offline by saving the webpage locally.

Why does my JWT start with 'eyJ'?

All JWTs start with 'eyJ' because the header JSON (typically {"alg":"HS256","typ":"JWT"}) begins with '{"' which Base64Url encodes to 'eyJ'. This is a reliable indicator that a string is a JWT token.

Can this tool verify JWT signatures?

No, signature verification requires the secret key (HMAC algorithms) or public key (RSA/ECDSA algorithms). Entering these keys into an online tool would be a serious security risk. Always verify signatures on your own secure servers using trusted libraries.

What does 'exp' mean in the payload?

The 'exp' (expiration) claim is a Unix timestamp indicating when the token expires. Tokens should be rejected after this time. For example, 'exp': 1735689600 means the token expires on January 1, 2025 at 00:00:00 UTC.

My token has three dots instead of two. Is it valid?

Standard JWTs have exactly two dots separating three parts (header.payload.signature). Extra dots indicate the token may be malformed, double-encoded, or not a standard JWT. Check your token generation code.

Can I use this tool for OAuth 2.0 tokens?

Yes! OAuth 2.0 access tokens and ID tokens (from OpenID Connect) are often JWTs. You can decode them to view user information, scopes, expiration times, and other claims. However, some OAuth providers use opaque tokens (random strings) which cannot be decoded.

What is the 'none' algorithm and why is it dangerous?

The 'none' algorithm means the token has no signature. If a server accepts tokens with 'alg': 'none', attackers can forge tokens by creating header/payload with any claims and no signature. Secure systems should always reject tokens with the 'none' algorithm.