JWT Decoder

What is a JWT?

A JSON Web Token (JWT), defined in RFC 7519, is a compact way to pass signed information between systems. It is used for login sessions, API authentication, OAuth and OpenID Connect ID tokens, and single sign-on. A JWT looks like three blocks of random characters separated by dots:

header.payload.signature

• The header says how the token is signed, for example {"alg":"HS256","typ":"JWT"}.
• The payload holds the claims: who the token is about, who issued it, when it expires and any custom data such as roles.
• The signature proves the header and payload were created by someone holding the key and have not been changed.

The header and payload are only Base64URL encoded, not encrypted. That is why a JWT decoder can read them without any key, and why you should never put passwords or sensitive personal data in a JWT payload.

Standard JWT claims explained

Time claims are shown as ISO dates next to the raw numbers. The status line tells you if the token has expired, is not yet valid, or has no expiry at all, which is a security smell for access tokens.

Verifying a JWT signature

Decoding is not the same as verifying. Anyone can create a token with any payload; only the signature proves it is genuine. For tokens signed with a shared secret (HS256, HS384, HS512), enter the secret and the tool recomputes the HMAC with your browser's Web Crypto API and compares it with the token's signature. Tick Secret is Base64 encoded if your framework stores the secret that way.

Tokens signed with public key algorithms (RS256, ES256, PS256, EdDSA) are verified with the issuer's public key, usually published at a JWKS URL; this tool decodes them but does not verify them.

Security warnings

• alg: none means the token is unsigned. Servers must never accept it.
• No exp means the token never expires. Access tokens should be short-lived, typically 5 to 60 minutes.
• Five parts instead of three means an encrypted JWE token, which cannot be read without the private key.

Why decoding in the browser matters

JWTs are often live credentials. Pasting a valid access token into a website that sends it to a server is like handing over a temporary password. This decoder runs entirely in your browser: the token, the secret and the decoded data are never uploaded, logged or stored. Even so, prefer test or expired tokens when debugging, and rotate any secret that may have been exposed.

Related tools: decode a single Base64URL segment with the Base64 decoder, convert exp and iat values with the Unix timestamp converter, format payloads with the JSON formatter, and compute HMAC-SHA256 values with the hash generator.

A decoded JWT example

Take this token (line breaks added for reading):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkphbmUiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTc2NzIyOTIwMH0
.4o9Q...

The first part decodes to {"alg":"HS256","typ":"JWT"} and the second to a payload with sub 1234, name Jane, role admin, an iat of 1 January 2026 00:00 UTC and an exp one hour later. The decoder shows each claim with its meaning and converts both times to dates, so you can see at once that the token lived for one hour.

This example also shows why authorization must never trust a payload without checking the signature: anyone could edit the payload to say "role":"admin" and re-encode it. Only a valid signature proves the server issued those claims.

JWT Decoder: frequently asked questions