JWT Token Decoder
Decode JWT tokens — read the header and payload instantly.
Decoded standard claims
Decoding only — the signature is not verified. Never paste production secrets.
How to use JWT Token Decoder
- Paste the JWT — the header.payload.signature string.
- Read the decoded header and payload — algorithm, claims, timestamps.
- Check exp first when debugging auth — expired tokens are the top cause of 401s.
- Remember: decoding ≠ verifying — your server must always validate the signature before trusting claims.
What is JWT Token Decoder?
A JWT decoder unpacks a JSON Web Token — the dot-separated header.payload.signature string that carries authentication and session data across the modern web — into readable JSON. It decodes the Base64URL header (algorithm, type) and payload (the claims: user ID, roles, expiry, issuer) so you can see exactly what a token asserts.
The critical thing to understand: a JWT is encoded, not encrypted. Anyone can decode and read the payload — it's Base64, not a secret. The signature doesn't hide the data; it proves the data wasn't tampered with. So JWTs must never carry secrets, and decoding one reveals everything it holds.
About the JWT Token Decoder
Paste a JWT and read its decoded header and payload — claims laid out, expiry and timestamps interpreted — all in your browser.
Where it earns its place: debugging authentication — the daily use: an API returns 401, and decoding the token shows whether it's expired (the exp claim vs now — the #1 cause), missing a role, or issued for the wrong audience; inspecting claims — confirming a token carries the user ID, permissions and scopes your app expects; reading expiry — exp, iat and nbf as human dates, diagnosing "logged out too soon" and clock-skew issues; and learning how JWT auth works — seeing real tokens demystifies the whole flow.
Security essentials this reinforces: decoding does NOT verify — a valid-looking decoded payload could be forged; only checking the signature against the secret/public key (server-side) proves authenticity, and your app must always do that. Never trust a JWT's claims without verifying its signature. And since decoding exposes the payload, treat production tokens like the credentials they are — this decoder runs entirely client-side, so nothing you paste is transmitted. See HMAC (which produces HS256 signatures) for the signing side.