What is JWT Decoder?
JWTs are common in modern authentication flows, but their compact format makes debugging difficult. When a token fails, you need quick visibility into header and payload claims.
JWT Decoder reveals the contents of a token in a safe, local way so you can inspect claims, timestamps, and metadata without sharing secrets.
JWTs are opaque during debugging
Base64url encoding hides header and payload data from quick inspection.
Expired or misconfigured tokens can break auth flows without obvious errors.
Developers sometimes paste tokens into untrusted tools, risking exposure.
Signature verification requires secrets that should not be shared or exposed.
Local decoding with clear limits
This tool decodes the header and payload locally in your browser, so tokens are not sent to a server.
It highlights standard claims like exp, iat, iss, and aud for quick validation.
It does not verify signatures or validate against a key, so use it for inspection only.
How to Use JWT Decoder
- 1Paste the token - Insert the JWT string.
- 2Review header - Check algorithm and token type.
- 3Inspect payload - Look at claims and user data.
- 4Check timestamps - Validate exp and iat values.
- 5Verify formats - Ensure claims match expected types.
- 6Debug in context - Compare with server-side validation results.
Key Features
- Header/payload decoding
- Expiration checking
- Formatted JSON output
- Copy decoded data
- Claim inspection
- Algorithm display
Benefits
- Debug authentication
- Verify token contents
- Inspect user claims
- Check token expiration
Use cases
Auth debugging
Inspect tokens during login failures.
API testing
Confirm claims before hitting endpoints.
QA validation
Verify expiration behavior in test flows.
Dev logs
Decode tokens embedded in logs.
Security review
Check scopes and roles quickly.
Client troubleshooting
Verify fields in shared tokens.
Integration testing
Validate issuer and audience values.
Token rotation
Compare old and new token claims.
Tips and common mistakes
Tips
- Treat tokens as sensitive data.
- Check exp and nbf claims for clock skew.
- Validate iss and aud against your environment.
- Avoid sharing tokens in public tickets.
- Use test tokens for demos.
- Compare payload types with your auth server.
- Remember base64url uses URL-safe characters.
- Use a verifier to confirm signatures in production.
Common mistakes
- Assuming decoding verifies authenticity.
- Pasting production tokens into untrusted tools.
- Ignoring clock skew when checking expiration.
- Confusing milliseconds and seconds for exp.
- Using decoded data as proof of identity.
- Sharing tokens in logs or screenshots.
- Treating JWTs as encrypted by default.
- Assuming all claims are standardized.
Technical Details
Decodes tokens per RFC 7519 (JSON Web Token).
All processing is performed client-side using JavaScript. No data is transmitted to external servers.
Educational notes
- JWTs are base64url encoded, not encrypted by default.
- Signature verification requires a key and trusted issuer.
- exp and iat are Unix timestamps in seconds.
- Clock skew can affect token validity checks.
- Payload data is readable if intercepted.
- Use short lifetimes for sensitive tokens.
- Do not log production tokens in plain text.
- Use JWE if you need encryption.
Frequently Asked Questions
Does decoding validate the token?
No. It only decodes; signature verification requires the secret or public key.
Are JWTs encrypted?
Not by default. Most JWTs are signed, not encrypted.
Is my token uploaded?
No. Decoding happens locally in your browser.
Why is exp not readable?
exp is a Unix timestamp in seconds; convert to a date for readability.
Can I edit claims here?
No. This tool is for inspection, not editing or re-signing.
Why does my token look invalid?
It may be malformed, missing parts, or not base64url encoded.
Does it support JWE?
No. Encrypted JWTs (JWE) require decryption keys.
What is the header alg claim?
It indicates the signing algorithm, such as HS256 or RS256.
Can I trust data in the payload?
Only if the signature is verified by your backend.
Does this check token expiration?
It displays exp; you must compare against current time.
Related tools
Explore More Developer Tools
JWT Decoder is part of our Developer Tools collection. Discover more free online tools to help with your development and coding.
View all Developer Tools