Intro
A JWT decoder helps you inspect the contents of a JSON Web Token without manually splitting and decoding it. JWTs are commonly used in authentication systems, APIs, single sign-on flows, and session handling. A token usually has three dot-separated parts: header, payload, and signature.
Because JWTs are base64url-encoded, they are readable after decoding but they are not automatically encrypted. That means you can inspect claims such as issuer, subject, expiration time, user ID, roles, or audience. A decoder is helpful when debugging login issues, checking whether a token is expired, validating expected claims, or understanding what an application is sending.
Example JWT format: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiaWF0IjoxNzAwMDAwMDAwfQ.signature
This example has the expected three parts separated by dots.
How to Use
1. Paste the JWT into the input field. 2. Click Decode. 3. Review the header to see the algorithm and token type. 4. Review the payload to inspect claims such as sub, exp, iat, aud, or role. 5. If needed, compare the decoded claims with your application logic.
Remember: decoding a token is not the same as verifying its signature.
Examples
- Header:
{ "alg": "HS256", "typ": "JWT" } - Payload:
{ "sub": "1234567890", "name": "Alice", "iat": 1700000000 } - Token format:
xxxxx.yyyyy.zzzzz
Tips
- Always check the
expclaim when debugging authentication issues. - Never paste sensitive production tokens into untrusted tools.
- Decoding only reveals content; it does not prove the token is valid.
- Use the header to confirm the expected signing algorithm.
FAQ
What is a JWT?
A JSON Web Token is a compact token format used to transfer claims between systems.
Why does a JWT have three parts?
The three parts represent the header, payload, and signature.
Can I trust decoded data immediately?
No. You must still verify the signature and token context.
Is a JWT encrypted?
Usually no. Standard JWTs are encoded, not encrypted.
What claims are commonly found in JWTs?
Common claims include sub, iss, aud, exp, iat, nbf, and custom application roles or IDs.