How to use the JWT Decoder

Paste a complete JWT — three Base64Url-encoded segments separated by dots. The decoder splits the segments, Base64Url-decodes each, parses the header and payload as JSON, and displays them with syntax-style coloring. Standard JWT claims (exp, iat, nbf, iss, aud, sub) get human-readable interpretation including expiration status.

Why this tool matters

JWTs are everywhere in modern auth — OAuth2, OpenID Connect, API keys, magic links, password reset tokens. Debugging “why doesn\u2019t my API call work?” almost always starts with decoding the token to inspect claims. Online JWT decoders exist but most send your token to a server — a bad habit for tokens that might still be valid. Our decoder runs entirely in your browser.

Common use cases

• Debugging “401 Unauthorized” responses by inspecting token claims
• Confirming a token has not expired
• Checking that the audience (aud) matches what your API expects
• Verifying which roles or scopes are encoded in a user\u2019s token
• Inspecting tokens from password reset links and magic-link emails
• Training new engineers on JWT structure

JWT structure: header.payload.signature

Every JWT has three parts. The header declares the algorithm (alg) and type (typ). The payload contains claims — standard ones like exp/iat/iss and custom ones like roles/permissions. The signature verifies the token was not tampered with. Decoding does not verify — anyone can decode any JWT. Only the issuer with the secret/key can verify.

Why we cannot verify signatures

Signature verification requires either the secret (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256). Neither is in the token itself. The token alone tells you what the issuer claimed; only the secret/key tells you it really was the issuer.

Frequently Asked Questions

Is it safe to paste my JWT into your tool?
Yes — the decoder runs entirely in your browser. Nothing is sent to any server. That said: if a token might still be active (not expired) and grants access to anything important, be cautious of any tool that might log it.

Can JWTs be encrypted?
Standard JWTs are signed but not encrypted — anyone can read the payload by Base64-decoding. For encrypted tokens use JWE (JSON Web Encryption), which is a different spec. Most authentication flows use signed-only JWTs because payload contents are not secret.

What does “JWT signature invalid” mean in my API logs?
Either the token was tampered with, was signed with a different key, or your verifier is using the wrong algorithm. Decode the header to confirm alg matches what your verifier expects.

Where can I learn more about JWT claims?
RFC 7519 defines the standard claims. iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), jti (JWT ID). Custom claims are free-form — common ones include “roles”, “scope”, “email”, “tenant_id”.