JWT Decoder

Paste any JWT to instantly decode its header and payload — inspect claims, expiration times, and signature without leaving your browser or sending data anywhere.

What is JWT Decoder?

A JWT (JSON Web Token) is the standard way modern web APIs represent authentication and authorization claims. It's a compact, self-contained token made of three parts — a header describing the signing algorithm, a payload carrying the actual claims (like user ID, roles, and expiration), and a signature that lets the receiving server verify the token hasn't been tampered with.

This decoder reads the header and payload instantly so you can debug authentication issues, inspect what claims an API is actually sending, or check when a token expires — all without needing a backend, a CLI tool, or pasting sensitive tokens into a third-party server, since everything runs locally in your browser.

Formula

JWT = base64Url(header) + "." + base64Url(payload) + "." + base64Url(signature)

Decoding: split on ".", base64Url-decode the first two parts, parse as JSON.

Verifying (not done here): HMACSHA256(base64Url(header) + "." + base64Url(payload), secret) === signature

How to Calculate

Paste your JWT into the input box, or click "Load Sample" to try one.
The header and payload are decoded automatically as you type.
Review claims like iss, sub, exp, and iat in plain readable form.
Timestamp claims (exp, iat, nbf) are automatically converted to readable dates.

Example

A token starting with eyJhbGciOiJIUzI1NiJ9 decodes to a header of {"alg":"HS256","typ":"JWT"} — telling you the token is signed with HMAC-SHA256.

Key Benefits

Decode any JWT instantly without a backend or CLI tool
Everything runs client-side — tokens are never sent to a server
Automatically converts timestamp claims to readable dates
Free, no sign-up, works on any JWT regardless of algorithm

Common Mistakes to Avoid

Assuming a decoded JWT is a verified JWT — decoding only reads the content, it doesn't confirm authenticity
Storing sensitive data (passwords, secrets) in the payload, forgetting it's readable by anyone
Pasting production tokens into untrusted online decoders
Confusing 'exp' (expiration) with 'iat' (issued at) when debugging token lifetime issues

Pro Tips

Always check 'exp' first when debugging an "unauthorized" error — an expired token is the most common cause
Cross-reference the 'alg' in the header with what your backend expects to catch algorithm-mismatch bugs
Never trust a decoded payload as proof of identity without verifying the signature server-side
Use short-lived tokens with refresh tokens instead of long-lived JWTs to limit exposure if one leaks

Key Terms Explained

Claim: A piece of information asserted about a subject, like a user ID or role
Header: The first JWT segment, specifying the signing algorithm and token type
Payload: The second JWT segment, containing the actual claims
Signature: The third JWT segment, used to verify the token hasn't been altered

Common Use Cases

Debugging why an API rejects a token by inspecting its claims
Checking a token's expiration time during a support investigation
Verifying an SSO or OAuth provider is issuing the claims you expect
Learning how JWTs are structured for interview prep or coursework
Quickly inspecting a token pasted from browser dev tools or server logs

Frequently Asked Questions

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: a header, a payload, and a signature.

Is it safe to paste my JWT into this tool?

Decoding happens entirely in your browser using JavaScript — the token is never sent to any server. That said, treat JWTs like passwords: avoid pasting tokens from production systems into any online tool, including this one.

Why can't this tool verify the signature?

Verifying a JWT's signature requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms) that only the issuing server should have. This tool only decodes the readable header and payload — it never has access to that key.

What does the 'exp' claim mean?

'exp' (Expiration Time) is a Unix timestamp indicating when the token stops being valid. This tool automatically converts it to a readable date so you can quickly check whether a token has expired.

Related Tools

Aspect Ratio Calculator

Bandwidth Calculator

Download Time Calculator

Cloud Hosting Cost Calculator

CDN Cost Calculator

API Monetization Calculator