Is the JWT Decoder free to use?

Yes, completely free. No signup, no API key, no usage limits. The JWT Decoder runs entirely in your browser as a client-side tool — you can use it as much as you want without any cost.

Does the JWT Decoder store my tokens?

No. All decoding happens locally in your browser. Your JWT tokens never leave your device, are never sent to any server, and are not stored in any database. Once you close or refresh the page, your input is gone. This makes the tool safe to use even with sensitive tokens.

What JWT algorithms are supported?

The JWT Decoder works with any JWT regardless of the signing algorithm. It can decode tokens signed with HMAC (HS256, HS384, HS512), RSA (RS256, RS384, RS512), ECDSA (ES256, ES384, ES512), and EdDSA algorithms. Since the tool only decodes (not verifies), the algorithm in the header is simply displayed — it does not affect decoding.

Can the JWT Decoder verify JWT signatures?

No, the JWT Decoder only decodes JWT tokens. It does not verify the cryptographic signature. Signature verification requires the secret key (for HMAC) or public key (for RSA/ECDSA), which we do not ask for. To verify a JWT signature, use a dedicated verification library in your backend code, such as jsonwebtoken (Node.js), PyJWT (Python), or jose (multi-language).

What's the difference between decoding and verifying a JWT?

Decoding a JWT simply reverses the base64url encoding on the header and payload to make them readable — anyone can do this, no keys needed. Verifying a JWT means cryptographically checking that the signature was created using the correct secret or private key, ensuring the token has not been tampered with. Decoding tells you what the token says; verification tells you whether you can trust what it says.

Are JWTs encrypted? Can anyone read my token contents?

Standard JWTs (JWS) are NOT encrypted. They are base64url-encoded and signed, but the header and payload are readable by anyone who has the token. Think of a JWT as a postcard — the message is in plain sight, and the signature is like a wax seal proving authenticity. If you need confidentiality (encryption), use JWE (JSON Web Encryption) tokens instead, which encrypt the payload.

What happens if my token is expired?

The JWT Decoder will still decode an expired token and show you all its claims. It will display a red "Expired" badge with the expiry date so you know the token is no longer valid. Most APIs will reject expired tokens, so you will typically need to request a new token from your authentication server or use a refresh token to get a new access token.

Can I use this tool with OAuth 2.0 or OpenID Connect tokens?

Yes. OAuth 2.0 access tokens and OpenID Connect ID tokens are commonly JWTs. You can paste them into the JWT Decoder to inspect the claims, check the issuer, audience, expiration, and any custom scopes or roles. This is especially useful for debugging authentication flows and understanding what claims your identity provider is including in tokens.

🛠️DevToolsHub

JWT Decoder

Decode JWT tokens and inspect header, payload, and signature.

What is JWT Decoder?

A JWT Decoder is a developer tool that decodes JSON Web Tokens (JWTs) into their three constituent parts — the header, payload, and signature — so you can inspect the claims and metadata encoded inside. JWTs are compact, URL-safe tokens defined by RFC 7519 and are widely used in modern web applications for authentication, authorization, and secure information exchange.

A JWT consists of three base64url-encoded segments separated by dots:header.payload.signature. The header describes the token type and signing algorithm. The payload contains claims — statements about an entity (typically a user) and additional metadata. The signature is used to verify the token has not been tampered with. Our JWT Decoder reverses the base64url encoding on the header and payload, presenting them as readable JSON, and displays the raw signature string.

Common use cases for a JWT Decoder include debugging authentication tokens during development, inspecting claims issued by your identity provider, checking token expiration times, verifying the correct audience and issuer are set, and understanding what information your auth server is embedding in tokens. Whether you are building OAuth 2.0 flows, working with OpenID Connect, or debugging a microservice authentication issue, a JWT Decoder is an essential tool in your development workflow.

How to Use JWT Decoder

Paste your JWT token into the input area above. You can also click Load Example to see how it works with a sample token.
The tool automatically decodes the token as you type (with a 300ms debounce) if the input looks like a JWT (contains two dots).
View the decoded Header and Payload as formatted JSON in the tabbed output panels.
Check the expiry status badge — green for valid, red for expired, amber for not-yet-valid, gray for unknown.
Review the Token Info section for a human-readable summary of standard claims (issuer, subject, audience, issued at, expires at).
Use the Copy button on each panel to copy the decoded JSON or signature to your clipboard.

JWT Structure Explained

A JWT is composed of three parts, each encoded using base64url encoding and joined by dots. Here is what each part contains:

Header

The header is a JSON object that identifies the token type (typ, typically "JWT") and the cryptographic algorithm (alg) used to sign the token. Common algorithms include HMAC with SHA-256 (HS256), RSA with SHA-256 (RS256), and ECDSA with SHA-256 (ES256). The header may also contain a key ID (kid) to help the verifier select the correct key.

Payload

The payload contains claims — statements about an entity and additional data. There are three types of claims:

Registered claims — predefined by the JWT specification: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID).
Private claims — custom claims defined by the parties using the JWT, such as role, name, email, or permissions.
Public claims — claims registered in the IANA JWT registry to avoid collisions.

All timestamps in JWT claims are Unix timestamps measured in seconds (not milliseconds).

Signature

The signature is created by taking the base64url-encoded header, the base64url-encoded payload, and signing them with a secret key (for HMAC algorithms) or a private key (for RSA/ECDSA). The signature ensures the token has not been modified after it was issued. To verify a JWT, the recipient re-computes the signature using the shared secret or public key and compares it to the signature in the token.

Base64url Encoding

JWTs use base64url encoding — a variant of standard base64 that replaces + with - and / with _, and omits padding (= characters). This makes JWTs safe to use in URLs, query parameters, and HTTP headers without additional encoding. The JWT Decoder reverses this encoding to reveal the original JSON content.

Security Considerations

⚠️ This tool only DECODES JWTs. It does NOT verify the signature.Decoding a JWT is like reading an open letter — anyone can do it. Verification is like checking the sender's signature with a notary — it proves authenticity. Never trust decoded JWT claims without proper signature verification in your backend.

Decoding ≠ Verification. Just because you can read the claims does not mean they are authentic. An attacker can forge a JWT with any claims they want. Always verify the signature using the correct secret or public key before trusting claims.
Never paste production tokens into online tools. Even though our tool runs client-side and does not store tokens, it is best practice to avoid pasting production access tokens into any web-based tool. Use test tokens for debugging, or run the decoder locally.
JWTs are not encrypted. The header and payload of a standard JWT (JWS) are base64url-encoded, not encrypted. Anyone who intercepts the token can read its full contents. If you need confidentiality, use JWE (JSON Web Encryption) tokens instead.
Treat tokens as credentials. A JWT is a bearer token — whoever possesses it can use it. Do not log tokens, share them in chat, or expose them in client-side code or URLs.

Features

Instant decoding — auto-decodes as you type (debounced 300ms)
Three-panel output — header, payload, and signature in separate tabs
Syntax-highlighted JSON — readable, formatted output with CodeEditor
Expiry status badge — color-coded indicator showing valid, expired, not-yet-valid, or unknown
Token info summary — standard claims (issuer, subject, audience, issued at, expires at) at a glance
Copy to clipboard — one-click copy for header, payload, and signature
Security warning — clear reminder that decoding is not verification
100% client-side — your tokens never leave your browser
Free with no signup — no account required, no usage limits
Dark mode support — works seamlessly in light and dark themes

Frequently Asked Questions