JWT Decoder Online

What Is a JWT Decoder?

A JWT decoder takes a JSON Web Token (the eyJ... string you see in auth headers) and reveals its three parts: the header, the payload, and the signature. JWTs are just Base64URL-encoded JSON joined by dots, so anyone holding the token can read it — decoding is not the same as verifying. Our free online JWT decoder runs locally in your browser: paste a token and instantly inspect the claims, check expiry, and see the signing algorithm. If the token arrives URL-encoded, our URL Encoder/Decoder can clean it first.

How to Decode a JWT (Step by Step)

1. Paste the token. Drop the full JWT (three dot-separated segments) into the input box.
2. Click Decode. The tool splits the token and Base64URL-decodes the first two parts.
3. Read the header. See the algorithm (alg) and token type (typ), plus any key ID.
4. Inspect the payload. View standard claims like sub, iss, aud, and exp.
5. Check expiry. The tool compares exp and iat to your clock and flags expired tokens.

For raw token blobs, our Base64 Encoder/Decoder helps you inspect other encoded values in the same flow.

Key Features

• Header and payload view pretty-printed as readable JSON.
• Expiry check that converts exp/iat/nbf to human dates and warns on expiry.
• Algorithm detection showing HS256, RS256, ES256, and friends from the header.
• Per-section copy of header, payload, or signature for tickets and postmortems.
• 100% local decode — the token never leaves your browser.

Common Use Cases

• Debugging auth flows — read what your app actually receives from the auth server.
• 401 troubleshooting — check whether a token is expired, missing claims, or using the wrong algorithm.
• OAuth / OpenID inspection — decode access tokens and ID tokens from Google, Auth0, or Cognito.
• Incident response — copy decoded claims into a report without exposing the raw secret.

JWT Decoder vs Verification

Decoding only reveals contents; it does not prove the token is genuine. Verification needs the issuer's secret (HS256) or public key (RS256/ES256), which this tool never asks for. For a quick structural look during development, decoding is enough — for trust decisions, verify with your auth provider's SDK. If you handle hashed values, our Hash Generator can help you compare digests in the same investigation.

Tips & Best Practices

• JWTs are encoded, not encrypted — never put passwords or secrets in the payload.
• An expired token can still decode; the red expiry flag tells you it should be rejected.
• Clock skew between your machine and the auth server can make exp/nbf look wrong — check system time.
• Treat any pasted token as compromised; rotate it if it was a long-lived credential.
• Use the algorithm in the header to pick the correct key before attempting verification elsewhere.

Privacy & Security

Decoding happens entirely in your browser. The token is never sent to a server, logged, or cached, which makes this safe for production access tokens during debugging. Still, avoid pasting real customer secrets, and rotate any token you paste into a web tool afterward.

JWT Decoder in Everyday Workflows

Engineers open this decoder the moment a 401 appears or an auth flow misbehaves. Paste the token, read the claims, and confirm expiry in seconds — no extension to install and no account to create. It turns an opaque eyJ... string into something a whole team can reason about during a debugging call.

When a token arrives inside a larger encoded blob, our Base64 Encoder/Decoder unpacks it first; when you are comparing digests during the same investigation, the Hash Generator helps verify values. Decoding is fully local, so you can inspect several tokens during an incident without exposing them to a server or leaving traces in someone else's logs.