Skip to content

JWT Decoder

Securely decode JSON Web Tokens (JWT) in your browser. View headers, payloads, and claims without sending data to a server.

Updated

What is the JWT Decoder?

JSON Web Tokens (JWT) are an open, industry-standard method for representing claims securely between two parties. Whether you are debugging an authentication flow, verifying API endpoints, tracking down permission bugs, or simply inspecting session data, you need a quick way to see what is inside your tokens.

Our JWT Decoder is designed for developers who value speed, accuracy, and absolute security. It instantly unpacks Base64Url-encoded strings into readable JSON formats, neatly separating the header, payload, and signature. Most importantly, it operates entirely locally in your browser—meaning your sensitive access tokens and personal data are never sent over the network or logged on a remote server.

How it works

A standard JSON Web Token consists of three distinct parts separated by dots (.): the Header, the Payload, and the Signature.

  1. Header: Contains metadata about the token itself, primarily the cryptographic algorithm being used (e.g., HS256 or RS256) and the token type.
  2. Payload: Contains the claims. Claims are verifiable statements about an entity (typically, a user) and additional data. These include standard registered claims like iss (issuer), exp (expiration time), and sub (subject), alongside any custom data your application requires.
  3. Signature: A cryptographic hash used to verify that the sender of the JWT is who it claims to be, ensuring the message hasn't been tampered with in transit.

The Decoding Process: When you paste a token, this tool immediately splits the string at the dots. It then applies a safe Base64Url decoding algorithm to the Header and Payload sections to convert them back into plain UTF-8 strings, which are then parsed into readable JSON objects.

Additionally, the tool analyzes time-based claims (like exp and nbf) against your system's current Unix timestamp, automatically calculating time-to-live countdowns and notifying you if the token has expired. All computation happens dynamically within the DOM, requiring zero backend processing.

Examples

Standard Authentication Token

Decoding a typical JWT to view the signing algorithm and user claims.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header: { "alg": "HS256", "typ": "JWT" } | Payload: { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }

Frequently asked questions

Is it safe to paste my production JWT here?

Yes, absolutely. This tool is fully client-side. The entire decoding process happens directly within your web browser using JavaScript. No tokens, payloads, or signatures are ever transmitted to our servers, saved to databases, or recorded in logs.

Can I edit my JWT and re-sign it here?

No, this tool is strictly a decoder, not a signer or generator. Modifying a token's payload will automatically invalidate its signature. To generate a new token or properly re-sign an edited one, you must have the original cryptographic secret key or private key, which should be kept strictly on your backend servers.

What do the standard JWT claims mean?

JWTs use abbreviated three-letter claims to keep the overall payload size small for HTTP headers. The most common standard claims include:

  • sub (Subject): The primary identifier for the user (often a user ID or email).
  • iss (Issuer): The server, domain, or authority that generated and issued the token.
  • exp (Expiration Time): The exact Unix timestamp when the token becomes invalid.
  • iat (Issued At): The Unix timestamp indicating exactly when the token was created.
  • aud (Audience): The intended recipient(s) or resource server the token is meant for.

Why does my token show as "Expired"?

If your token contains an exp (expiration) claim, our decoder compares that specific Unix timestamp against your system's current time. If the designated exp time has passed, the token is officially dead and will be rejected by any properly configured API or backend server.

Why is my token failing to decode?

If you receive a malformed token error, ensure you have copied the entire string without missing characters. A valid JWT must contain exactly three base64-encoded segments separated by two periods (.). Extraneous whitespace or missing signature blocks will cause parsing errors.

Related tools

More utilities you might find handy.

Developer

.env File Generator

Quickly generate clean, properly-quoted .env files from key-value pairs — no more quoting errors or broken deployments.
Developer

.htaccess Redirect Builder

Generate error-free Apache .htaccess code for 301 redirects, HTTPS enforcement, and canonical URL routing.
Developer

ASCII Converter – Text to ASCII, Hex, Binary & Back

Convert text to ASCII codes and decode back in decimal, hex, binary, or octal — live, private, and 100% browser-based.