JWT Decoder

How to Use the JWT Decoder

1. Paste your JWT token — Copy the complete JWT string (including all three parts separated by dots) from your browser, API response, or authorization header, and paste it into the input textarea.
2. Decode the token — Click the Decode JWT button, or enable the auto-decode toggle to decode tokens instantly as you paste them. The tool will split the token into its three components.
3. Inspect the header — View the decoded header JSON showing the signing algorithm (alg) and token type (typ). Verify the algorithm matches what your application expects.
4. Review the payload — Examine all claims in the payload. Standard claims like exp, iat, sub, and iss are highlighted with badges. Check the expiration status banner to see if the token is still valid.
5. Check the signature — The signature portion is displayed, but remember that this tool does not verify the cryptographic signature. You need the signing key to verify it on your server.

Features

• Instantly decode JWT tokens into header, payload, and signature components
• Syntax-highlighted JSON output for both header and payload sections
• Automatic expiration detection with clear Expired or Valid until status banner
• Issued at (iat) timestamp displayed in human-readable format
• Special JWT claims (iss, sub, aud, exp, nbf, iat, jti) highlighted with descriptive badges
• Complete claim reference table showing all standard JWT claims with descriptions
• Copy buttons for both header and payload JSON for quick reuse
• Auto-decode toggle for real-time decoding as you paste tokens
• Load sample JWT button to see a fully populated example token
• Clear error messages for invalid tokens — wrong structure, bad Base64, or invalid JSON
• 100% client-side processing — no tokens or data are ever sent to a server
• Responsive design that works on desktop, tablet, and mobile devices

Understanding JSON Web Tokens

Common Use Cases

JWT Decoder Tips

• JWT uses Base64URL encoding for its header and payload. If you need to encode or decode raw Base64 (not JWT-specific), use our Base64 Encoder which handles standard Base64, Base64URL, and UTF-8 correctly.
• After decoding a JWT, if you want to validate the JSON structure of the header or payload separately, copy the decoded JSON and paste it into our JSON Validator to check for syntax errors and view structural statistics.
• To beautify the decoded JWT payload with proper indentation and syntax highlighting outside the decoder, paste it into our JSON Formatter which offers color-coded output, minification, and various indentation options.
• JWT signatures are created using hash functions like SHA-256. If you are curious about how hashing works or need to generate hashes, try our Hash Generator to create MD5, SHA-1, SHA-256, and SHA-512 hashes from any text input.
• Enable the auto-decode toggle for instant feedback as you paste tokens. This is especially useful when debugging authentication flows where you are rapidly inspecting multiple tokens from browser DevTools or API logs.
• The claim reference table at the bottom highlights which standard JWT claims (iss, sub, aud, exp, nbf, iat, jti) are present in your token, so you can quickly verify that all required claims are included.
• Remember that anyone who intercepts a JWT can decode its header and payload — the security comes from the signature, not from hiding the data. Never store passwords, credit card numbers, or other sensitive data in JWT payloads.
• If the token shows as expired, check your server's clock synchronization. Token expiration is based on Unix timestamps, so clock skew between the issuing server and verifying server can cause premature expiration errors.