All Tools
Copied!
Free Online Tool

JWT Decoder

Decode any JSON Web Token instantly. No data leaves your browser.

Invalid JWT format. Expected 3 dot-separated parts.

How to Decode a JWT

  1. Copy your JWT token from your application or authentication response.
  2. Paste the token into the input field above. The decoder auto-detects on paste.
  3. Click the Decode button or wait for auto-detection.
  4. View the Header section to see the algorithm and token type.
  5. Review the Payload section for all claims including issuer, subject, and expiration.
  6. Check the Signature section to inspect the raw signature bytes.
  7. Use the Copy buttons to extract specific sections as needed.
  8. Monitor the countdown timer to see remaining token validity.

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. Defined by the open standard RFC 7519, JWTs are widely used for authentication, authorization, and information exchange in modern web applications and APIs. A JWT consists of three parts separated by dots (.) — a header, a payload, and a signature — each encoded in Base64URL format.

How JWT Works

When a user authenticates successfully, the server generates a JWT containing claims about the user (such as their ID, role, or permissions) along with metadata like issuance and expiration times. The token is signed using a secret key (HMAC) or a private key (RSA/ECDSA) to ensure integrity. The client stores this token (typically in localStorage, sessionStorage, or an HTTP-only cookie) and includes it in subsequent API requests via the Authorization: Bearer <token> header.

JWT Structure

The header contains metadata about the token, including the signing algorithm (alg) and token type (typ). The payload carries the claims — registered claims like iss (issuer), sub (subject), exp (expiration), and custom claims defined by the application. The signature is computed by combining the encoded header and payload with a secret and signing algorithm, preventing tampering.

Common Use Cases

JWTs are ubiquitous in single sign-on (SSO) systems, OAuth 2.0 and OpenID Connect flows, REST API authentication, microservice-to-microservice communication, and stateless session management. Major identity providers including Auth0, Okta, Firebase, and Azure AD all rely on JWTs for secure token exchange.

Security Considerations

While JWTs are signed to prevent tampering, the payload is not encrypted by default — anyone with the token can Base64-decode and read its contents. Never store sensitive data (passwords, credit card numbers) in a JWT payload. Always validate the signature on the server side, enforce exp and nbf checks, use HTTPS, and rotate signing keys regularly. For sensitive claims, use JWE (JSON Web Encryption) in addition to signing.

Why Use a JWT Decoder?

A JWT decoder tool like this one helps developers debug authentication flows, inspect tokens during development, verify claim values, check expiration times, and understand the structure of JWTs from different providers. Since decoding happens entirely in your browser, no token data is ever sent to a server — keeping your tokens and their contents private.

Standard JWT Claims Reference

The JWT specification defines several registered claim names: iss (Issuer) identifies the principal that issued the JWT; sub (Subject) identifies the principal that is the subject of the JWT; aud (Audience) identifies the recipients for whom the JWT is intended; exp (Expiration Time) identifies the time after which the JWT must not be accepted; nbf (Not Before) identifies the time before which the JWT must not be accepted; iat (Issued At) identifies the time at which the JWT was issued; and jti (JWT ID) provides a unique identifier for the JWT.

Frequently Asked Questions

What is a JWT token used for?
JWTs are used for authentication and authorization in web applications and APIs. They securely transmit claims between parties as a JSON object that is digitally signed, enabling stateless session management, single sign-on (SSO), and secure API access without server-side session storage.
Is it safe to decode a JWT online?
Yes, because this tool decodes JWTs entirely in your browser using JavaScript. No token data is transmitted to any server. All processing happens locally on your device, so your tokens and their contents remain private. You can verify this by checking the browser's network tab.
Can I verify a JWT signature with this tool?
No, this tool only decodes JWTs. Signature verification requires the secret key (for HMAC) or public key (for RSA/ECDSA) which this tool does not have access to. You should always verify signatures on your server using a proper JWT library.
What is the difference between JWT header and payload?
The header contains metadata about the token itself, such as the signing algorithm (alg) and token type (typ). The payload contains the actual claims or data being transmitted, such as user ID, expiration time, issuer, and any custom data. Both are Base64URL-encoded JSON objects.
What does "exp" mean in a JWT?
The "exp" (Expiration Time) claim identifies the time after which the JWT must not be accepted for processing. It is a numeric date value (Unix timestamp). This tool converts it to a human-readable date and shows a countdown timer indicating whether the token is still valid or has expired.
What JWTs algorithms are supported?
This tool can decode JWTs using any algorithm because it only reads the header and payload (which are always Base64URL-encoded JSON). Common algorithms include HS256, HS384, HS512 (HMAC), RS256, RS384, RS512 (RSA), ES256, ES384, ES512 (ECDSA), and EdDSA (Edwards-curve).
Can a JWT contain sensitive information?
Technically yes, but it is strongly discouraged. JWTs are signed, not encrypted. The payload is Base64URL-encoded, not encrypted, meaning anyone with the token can read its contents. Never store sensitive data like passwords, credit card numbers, or personal identifiable information (PII) in a JWT payload without additional encryption (JWE).
What does "kid" mean in a JWT header?
The "kid" (Key ID) claim in the JWT header is a hint indicating which key was used to sign the token. This is useful when an authorization server uses multiple signing keys and rotates them periodically. The kid value helps the verifier locate the correct key from a set of public keys.
How do JWTs differ from session cookies?
JWTs are stateless — all user information is contained within the token itself, so the server does not need to store session data. Session cookies typically reference a server-side session store. JWTs can also be used across different domains and services, making them ideal for microservices and SSO architectures.
What is Base64URL encoding in JWTs?
Base64URL is a variant of Base64 encoding that makes the output URL-safe. It replaces "+" with "-" and "/" with "_", and removes trailing "=" padding. JWTs use Base64URL encoding because tokens are often included in URLs and HTTP headers where certain characters have special meaning.
How do I validate a JWT on my server?
Use a JWT library for your programming language (e.g., jsonwebtoken for Node.js, PyJWT for Python, jose4j for Java). Validation typically involves: verifying the signature using the secret or public key, checking the exp claim (token not expired), checking nbf (if present), verifying the iss claim, and validating the aud claim matches your application.
Can I use this tool offline?
Yes, once the page is loaded, the tool works completely offline. All JWT decoding is performed client-side using JavaScript's built-in atob() function and JSON parsing. No network requests are made during decoding. You can even save the page locally and use it without an internet connection.

© 2024 Toolkit Easy. All rights reserved.