JWT Decoder

What Is a JSON Web Token (JWT)?

A JSON Web Token, or JWT, is a compact, URL-safe way of representing claims to be transferred between two parties. It is widely used for authentication and authorization: after a user logs in, a server issues a signed token that the client sends back on subsequent requests to prove who it is, without the server having to store session state. The token is self-contained — everything the server needs to identify the user and check permissions travels inside the token itself.

A JWT is made of three parts separated by dots: a header, a payload, and a signature, written as header.payload.signature. The header and payload are JSON objects encoded with Base64URL (a URL-safe variant of Base64), and the signature is a cryptographic hash of the first two parts using a secret or private key. The header declares the signing algorithm (for example HS256 or RS256) and the token type. The payload carries the claims — statements about the user and the token. Crucially, Base64URL is encoding, not encryption: anyone holding the token can read the header and payload, which is exactly what this decoder does.

How to Use This JWT Decoder

Paste your token into the Paste JWT Token box. The tool decodes automatically a moment after you stop typing, or you can click the Decode button explicitly. It splits the token on its dots, Base64URL-decodes the first two segments, and displays the parsed Header, Payload, and raw Signature in three clearly labelled sections, each shown as pretty-printed JSON.

Below the three sections, a Decoded Claims table lists every claim in the payload alongside a human-readable description for recognized standard claims. Timestamp claims such as exp, nbf, iat, and auth_time are converted from Unix epoch seconds into a readable ISO date with a relative time (for example, "in 2h 15m" or "3d 4h ago"). If the token carries an expiration, a status banner tells you whether it is still valid or has already expired. The Clear button resets the input and hides the results. If the token does not split into exactly three parts, or a segment isn't valid Base64URL JSON, the tool reports a clear error instead of guessing.

Real-World Use Cases

• Debugging login flows — inspect the token your auth provider returns to confirm the right claims, issuer, and audience are present.
• Checking expiration — quickly see whether an exp claim has already passed when an API starts returning 401 errors.
• Verifying user roles and scopes — read the role, roles, or scope claims to confirm a user has the permissions a protected endpoint expects.
• Inspecting OpenID Connect ID tokens — examine claims like azp, nonce, at_hash, and auth_time when integrating with an identity provider.
• Comparing tokens across environments — decode tokens from staging and production to spot configuration differences in issuer or audience values.

Tips for Working With JWTs

• Remember that a JWT is signed, not encrypted — never store secrets or sensitive personal data in the payload, since anyone with the token can read it.
• Always check the exp claim; this decoder converts it to a readable date and tells you up front whether the token has expired.
• Decoding is not the same as verifying — to trust a token in production you must validate its signature against the issuer's key on your server.
• Watch the iss (issuer) and aud (audience) claims; mismatches here are a common cause of tokens being rejected by an API.
• Because the header reveals the signing algorithm, a header showing alg: none is a red flag that the token may be unsigned and should not be trusted.

Features

• Three-part breakdown — displays the decoded header, payload, and raw signature in separate, labelled sections.
• Auto-decode — decodes as you type, with an explicit Decode button as well.
• Claims table — lists every payload claim with descriptions for recognized standard and OIDC claims.
• Human-readable timestamps — converts exp, nbf, iat, and auth_time into ISO dates with relative time.
• Expiration status — shows whether the token is still valid or has already expired.
• Clear error reporting — flags tokens that don't have three parts or contain invalid Base64URL JSON.
• 100% client-side — your data never leaves your browser.

Frequently Asked Questions

What are the three parts of a JWT?

A JWT consists of a header, a payload, and a signature, joined by dots as header.payload.signature. The header describes the signing algorithm and token type, the payload holds the claims about the user or token, and the signature is a cryptographic hash that lets a server verify the token hasn't been tampered with.

Does this tool verify the token's signature?

No. This tool only decodes the header and payload so you can read their contents. It does not check the signature, which requires the issuer's secret or public key. Always verify signatures on your server before trusting a token in production.

Is it safe to paste a token here?

The decoding runs entirely in your browser using JavaScript, so the token is never uploaded or stored anywhere. That said, treat real tokens as credentials — avoid pasting production tokens into any tool unless you understand and trust where it runs, and prefer expired or test tokens when possible.

Why does the tool say my token has expired?

If the payload contains an exp claim whose timestamp is earlier than the current time, the token is past its expiration and the tool flags it. Expired tokens are normally rejected by servers, so you would need to obtain a fresh one through your authentication flow.

Can I read a JWT without the secret key?

Yes. The header and payload are only Base64URL-encoded, not encrypted, so anyone can decode and read them without any key. The key is required only to create or verify the signature, not to view the token's contents.

What happens if I paste an invalid token?

If the input doesn't split into exactly three dot-separated parts, or a segment isn't valid Base64URL-encoded JSON, the tool shows a descriptive error message instead of producing partial or misleading output, so you know the token is malformed.