JWT Decoder
Decode and verify JSON Web Tokens
Signature Verification
Paste a JWT token above
Header, payload, and claims decode instantly — nothing leaves your browser
What is a JWT (JSON Web Token)?
A JWT (JSON Web Token) is a compact, URL-safe token format that securely transmits information between two parties. It's structured as three Base64URL-encoded parts separated by dots: header (algorithm and token type), payload (claims or user data), and signature (proof of authenticity). JWTs are stateless—the server doesn't need to store session data because all information is contained in the token itself and cryptographically signed. This makes JWTs ideal for distributed systems, mobile apps, and APIs where traditional session-based authentication is impractical or inefficient.
The JWT format is defined by RFC 7519 and is widely adopted across the industry for OAuth 2.0, OpenID Connect, and REST APIs. When a user authenticates, the server generates a JWT containing their identity and permissions, and the client includes this token in subsequent requests. The server validates the signature to ensure the token hasn't been tampered with and hasn't expired. Unlike opaque tokens that require database lookups, JWTs can be validated without any server-side state, making them extremely scalable for modern cloud architectures.
Common Use Cases
- Debugging Auth Flows: Decode JWTs to inspect payload claims and verify they contain expected user data. Useful for troubleshooting why a user has (or doesn't have) certain permissions in your application.
- Inspecting Token Expiry: Check the exp (expiration) and iat (issued-at) claims to understand token lifespan. Helps debug "token expired" errors and verify token refresh mechanisms are working.
- Checking User Roles/Permissions: Examine custom claims in the payload to see what roles and permissions are assigned to a token. Essential for debugging authorization failures in microservices.
- Verifying Token Structure: Quickly validate that a JWT conforms to RFC 7519 structure before processing it in code. Catches malformed tokens early and prevents parsing errors.
- API Development and Testing: Generate sample tokens with different claims and expiry times to test various scenarios (expired token, missing claims, invalid signature) without going through the full auth flow.
How to Use This Tool
- Paste JWT Token: Copy and paste your JWT into the input textarea. The decoder accepts the standard format: eyJhbGc...eyJzdWI...SflKxw...
- View Decoded Content: The decoder automatically displays the header, payload, and signature in separate tabs. Header shows algorithm and token type, payload shows all claims with descriptions.
- Check Expiry Status: The tool displays the token's expiration status (valid, expired, or expiring soon) prominently at the top. The exp claim is converted to a human-readable date and relative time.
- Inspect Claims: Each claim in the payload is labeled with its standard RFC name and description. Custom claims are also displayed and highlighted for easy identification.
- Optional Signature Verification: Enable verification mode and provide the secret key (for HS256) or public key (for RS256, ES256, etc.) to cryptographically verify the token hasn't been tampered with.
Features
Three-Part Breakdown
Decode and display header (algorithm, token type), payload (all claims), and signature separately. Color-coded tabs make it easy to navigate between sections.
Expiry Detection
Automatically detect and display token expiration status. Shows both absolute expiry date and relative time (e.g., "expires in 2 hours"). Essential for debugging timeout issues.
Claims Documentation
Descriptions for standard RFC 7519 claims (iss, sub, exp, iat, aud, etc.). Custom claims are also supported and displayed for debugging application-specific data.
Signature Verification
Optional verification mode supports symmetric (HS256) and asymmetric (RS256, ES256) algorithms. Verify token authenticity without trust issues when the key is available.
Frequently Asked Questions
Is it safe to decode a JWT here?
Yes, decoding a JWT is completely safe. This tool runs entirely in your browser—no data is sent to external servers. The payload is just Base64URL-encoded, not encrypted, so anyone can decode it. However, never share secrets or private keys online. Use this tool only for debugging and inspecting tokens you own or have permission to access.
Can I verify a JWT signature here?
Yes, enable verification mode and provide your secret key (for symmetric algorithms like HS256) or public key in PEM format (for asymmetric algorithms like RS256). The tool verifies the signature cryptographically. Never enter production secrets into any online tool—copy this code to your own server for production verification.
What is the difference between exp and iat claims?
The iat (issued-at) claim indicates when the token was created (Unix timestamp). The exp (expiration) claim indicates when the token becomes invalid. Both are Unix timestamps (seconds since Jan 1, 1970). A token is valid from iat to exp; after exp passes, the token must be refreshed or the user must re-authenticate.
What is the difference between JWT and session tokens?
Session tokens are opaque strings that require the server to look up session data in a database or store. JWTs are self-contained and include all necessary information in the token itself, eliminating database lookups. JWTs scale better for distributed systems, but session tokens offer easier revocation. Modern applications often use JWTs with short expiry and refresh tokens for better security.
Why is my JWT expired?
A JWT expires when the current time exceeds the exp (expiration) claim. Check if your token was issued a long time ago, or if the system time is incorrect. For expired tokens, use the refresh token endpoint to get a new JWT, or re-authenticate the user through the login flow.