JWT Decoder
Decode JWT tokens to see header and payload. Check expiration status. No data sent to server. Free online JWT decoder.
What is JWT Decoder?
A JWT (JSON Web Token) decoder parses and displays the contents of a JWT without needing the secret key. JWTs are the standard authentication token format used by OAuth 2.0, OpenID Connect, and most modern web APIs. They consist of three Base64-encoded parts: a header (algorithm and type), a payload (claims like user ID, roles, expiration time), and a signature. This tool lets you inspect any JWT to see its claims, check expiration times, verify the algorithm, and debug authentication issues — all without server access.
How It Works
Paste a JWT string and the tool splits it on the two period (.) delimiters into header, payload, and signature. It Base64URL-decodes the header and payload sections, then parses the resulting JSON. The decoded data is displayed with proper formatting. Timestamp claims (iat, exp, nbf) are converted to human-readable dates so you can instantly see when the token was issued, when it expires, and whether it's currently valid. The signature portion is displayed but cannot be verified without the secret key.
Examples
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NSIsIm5hbWUiOiJBbGljZSIsImV4cCI6MTcwMDAwMDAwMH0.abc123
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "12345", "name": "Alice", "exp": 1700000000 }
exp → 14 Nov 2023 22:13:20 UTC (expired)
Signature NOT verified — decoding requires no key.Common Use Cases
- •Debugging authentication failures by inspecting token claims and expiration times
- •Verifying that login flows issue tokens with the correct user roles and permissions
- •Checking token expiration to understand why API calls return 401 Unauthorized
- •Inspecting third-party OAuth tokens to understand what claims and scopes are included
- •Debugging SSO (Single Sign-On) issues by examining identity provider tokens
- •Verifying token structure during API development and integration testing
Frequently Asked Questions
Does this validate the JWT signature?▼
No, this tool only decodes the token to show its contents. Signature verification requires the secret key.
Does decoding a JWT verify that it is valid?▼
No, and the distinction matters. Decoding just Base64URL-decodes the header and payload, which anyone can do. Verifying means checking the signature against the issuer's secret or public key, and that requires the key. A decoded token tells you what it claims, not whether the claim is true.
Is it safe to paste a token here?▼
Decoding happens entirely in your browser and nothing is transmitted. Even so, treat a live token as a live credential: anyone holding it can act as that user until it expires. Prefer expired or test tokens, and if you must decode a production token, revoke or rotate it afterwards.
Why is the payload readable without any key?▼
Because a signed JWT is encoded, not encrypted. The signature guarantees the payload has not been altered; it does nothing to hide it. Never place passwords, card numbers or personal data in a JWT payload — use JWE if you genuinely need the contents concealed.
What do the standard claim names mean?▼
`iss` is the issuer, `sub` the subject (usually the user id), `aud` the intended audience, `exp` the expiry time, `nbf` the time before which the token is invalid, `iat` when it was issued and `jti` a unique token id. The three time claims are Unix timestamps in seconds, not milliseconds.
What is the alg: none vulnerability?▼
A token can declare `"alg": "none"` in its header, claiming it needs no signature. A verifier that trusts the header to choose the algorithm will then accept a forged token. Always pin the expected algorithm on the server side rather than reading it from the token, and reject `none`.
How do I tell when a token expires?▼
Read the `exp` claim and convert it from a Unix timestamp; the Epoch Converter tool will do this. Remember it is in seconds, so a value multiplied by 1,000 by mistake lands in the year 55000. A token whose `exp` is in the past should be rejected regardless of a valid signature.
Related Tools
More from Developer Tools:
Base64 Encoder/Decoder
Encode and decode Base64 strings instantly. Free online Base64 converter tool for text and files. Works entirely in your browser.
JSON Formatter
Format, validate, and beautify JSON data online. Free JSON formatter with syntax highlighting, error detection, and minify option.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text. Uses browser's Web Crypto API for secure hashing.