Developer Tool

JWT Decoder

Decode and inspect JSON Web Tokens. View header, payload, and signature separately with expiration status.

JWT Token

Introduction

JSON Web Tokens (JWTs) are the dominant mechanism for stateless authentication in modern web applications, but their Base64URL-encoded payload is opaque at a glance. When debugging an authentication failure, checking token expiration, or verifying that the correct user roles are encoded in a claim, you need to decode the token and inspect its header, payload, and signature. A JWT decoder splits the token into its three parts, decodes the Base64URL segments, and presents the claims in a readable, formatted view.

What Is JWT Decoder?

A JWT decoder parses a JSON Web Token — a three-part string separated by dots (header.payload.signature) — and decodes the Base64URL-encoded header and payload segments into their original JSON structures. The header typically contains the algorithm ("alg") and token type ("typ"), while the payload carries the claims: standard registered claims like "iss" (issuer), "sub" (subject), "aud" (audience), "exp" (expiration), "iat" (issued-at), and any custom claims your application defines such as "role", "permissions", or "org_id".

The decoder automatically converts timestamp claims (exp, iat, nbf) from Unix epoch seconds into human-readable dates and highlights whether the token has expired. This single feature saves developers from the error-prone process of copying the exp value, opening a terminal, running date -r, and mentally comparing the result. The tool also flags missing required claims and warns about insecure algorithm choices like "none" or "HS256" with a short key.

For signature verification, the decoder can validate the token against a provided public key or shared secret. When a key is supplied, it recomputes the HMAC or RSA signature and compares it against the token's signature segment, confirming whether the token has been tampered with. This is critical during development when you need to verify that your auth server is signing tokens correctly before deploying to production, or when investigating whether a token was forged in a security incident.

JWT Decoder Examples

Input	Output
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0....	Header: {"alg":"HS256"}, Payload: {"sub":"1234567890"}
Token with exp: 1709251200	Expires: March 1, 2024 00:00 UTC — Token EXPIRED (red indicator)
Token + RS256 public key verification	Signature VALID — token was signed by the holder of the matching private key

Key Features of JWT Decoder

Automatic splitting and Base64URL decoding of header, payload, and signature segments
Human-readable timestamp conversion for exp, iat, and nbf claims with expiration status indicator
Registered claim descriptions mapping abbreviations like "iss", "sub", and "aud" to their full names
Signature verification against HS256/HS384/HS512 secrets and RS256/RS384/RS512 public keys
Security warnings for the "none" algorithm, short HMAC keys, and expired tokens
Formatted JSON display with syntax highlighting and collapsible sections for each token part
One-click copy of the decoded header or payload JSON for pasting into documentation and bug reports

How It Works

Paste Your JWT Token

Copy the full JSON Web Token string, which consists of three Base64URL-encoded segments separated by dots, and paste it into the input field. The token typically comes from an Authorization header, a cookie value, or an OAuth response that you want to inspect.

Decode Header and Payload Sections

The decoder separates the token into its three parts and Base64URL-decodes the header and payload segments into readable JSON. The header reveals the token type and signing algorithm, while the payload exposes all claims such as user ID, roles, expiration time, and issuer.

Review Claims in Formatted JSON

The decoded header and payload are displayed as neatly formatted JSON with syntax highlighting, making it easy to read individual claims. Timestamps like exp and iat are converted from Unix epoch to human-readable dates so you can quickly check if a token has expired.

Who Uses This

Backend Developers

inspecting JWT tokens during authentication debugging to verify that the correct user ID, roles, and scopes are being issued after login and that expiration timestamps align with their session configuration

Security Auditors

examining JWT claims to verify that tokens do not contain overly broad permissions, that algorithm restrictions are properly set in the header, and that sensitive data is not being exposed in the payload

Frontend Developers

decoding tokens stored in localStorage or cookies to check the current user's permissions and session expiry before making API calls, enabling client-side access control decisions without additional network requests

Related Tools

Utility

JSON Validator

Validate JSON syntax with error line and column numbers

Try it Dev

JSON Formatter

Format and beautify JSON data with syntax validation

Try it Utility

Base64 Tool

Encode or decode Base64 strings for data transport

Try it Utility

Hash Generator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums

Try it

Frequently Asked Questions

Does the decoder verify the token signature?

The tool decodes the header and payload but does not verify the cryptographic signature. Signature verification requires the secret key or public key, which is not something you should paste into a web tool. Use the decoder for inspecting claims, and verify signatures in your server-side code.

What happens if I paste an invalid or malformed JWT?

The decoder validates the token structure and reports an error if the format is incorrect, such as missing segments or non-Base64URL characters. This helps you quickly identify whether a token has been truncated, corrupted, or improperly generated.

Are the timestamps in the payload converted to readable dates?

Yes. Standard JWT timestamp claims like exp (expiration), iat (issued at), and nbf (not before) are automatically converted from Unix epoch seconds into human-readable date and time strings alongside the raw numeric values.