JWT Decoder

What is a JWT decoder?

A JWT decoder reads the Base64URL-encoded header and payload of a JSON Web Token and displays their JSON content. Decoding is useful for inspection and debugging, but it does not verify who created the token.

How to decode a JWT

1. Paste the token into the input above.
2. Inspect the header for the declared algorithm, token type, and key ID.
3. Inspect the payload for identity, audience, role, and permission claims.
4. Check exp, iat, and nbf timing details.
5. Remember that decoding is not signature verification.

What are the parts of a JWT?

A compact JWT usually contains three dot-separated parts. The header declares metadata such as the signing algorithm. The payload contains claims. The signature lets a verifier detect modification and confirm the expected issuer key was used.

Common JWT claims

iss is the issuer, sub is the subject, aud is the intended audience, exp is expiration, nbf is not-before, iat is issued-at, and jti is a unique JWT identifier.

JWT decoder vs JWT verifier

A decoder shows token contents. A verifier checks the signature using a trusted secret or public key and also enforces claims such as issuer, audience, and time limits. Never trust decoded data until the token has been verified by the application that receives it.

Private browser-based decoding

This tool runs in your browser and does not upload or store the token. JWTs may still contain sensitive user and authorization data, so avoid pasting production tokens unnecessarily.

JWT security best practices

Keep access tokens short-lived, validate the signature and expected algorithm, enforce issuer and audience checks, and allow only small clock-skew tolerances for time claims. Do not place secrets or unnecessary personal data in a JWT payload because signed JWT contents are encoded, not encrypted.