JWT Decode

Key takeaways

• Decode header and payload locally
• Shows iat / exp / nbf as ISO times when present
• Signature is not verified
• Tokens are not uploaded

What is a JWT?

A JSON Web Token is a compact, Base64URL-encoded structure (typically header.payload.signature) used to carry claims between parties.

Decoding reads the JSON segments. Verification checks the signature with a key and algorithm. This page only decodes. Never trust exp, roles, or other claims from an unverified token in production logic.

Features

• Header & payload JSON

  Pretty-prints decoded segments with algorithm and claim fields.

• Claim helpers

  Shows issued-at, expiry, and not-before as ISO timestamps when present.

• Bearer prefix tolerant

  Paste Authorization: Bearer … values; the prefix is stripped.

• Private by default

  Tokens stay on your device — never POSTed to a server.

How it works

1. 1

   Paste a JWT

   Use a compact token (header.payload.signature) from logs or DevTools.

2. 2

   Decode

   Base64URL segments are decoded to JSON. Signature bytes are not verified.

3. 3

   Inspect claims

   Review alg, sub, exp, and custom claims in the formatted output.

Example walkthroughs

• Sample HS256-shaped token

  Decodes a classic demo token into header, payload, and signature metadata.

  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

• Issuer and audience claims

  Shows iss, aud, iat, and exp style claims — still display-only; signature is not verified.

  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzQyIiwiYXVkIjoiYXBpLnJzcm9zaGkuZGV2IiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE4MDAwMDAwMDB9.demo-signature-not-verified

Common JWT registered claims

Use cases

• Debug auth failures

  Confirm expiry and audience claims when APIs return 401.

• Inspect SSO cookies

  Read payload fields from session JWTs during local development.

• Document APIs

  Show example claim shapes in internal runbooks.

Code snippets

• Split a compact JWT

  js

  JWT Decode performs this split and pretty-prints header + payload.

  const [header, payload] = token.split(".");
  // decode each Base64URL segment → JSON

Common errors

• Invalid JWT format

  Cause: The token is missing segments or is a JWE / opaque string.

  Fix: Paste a compact JWS with header.payload.signature (two or three parts).

• Claims look trusted but auth still fails

  Cause: This tool does not verify signatures.

  Fix: Validate signatures with your auth library; use decode only for inspection.

About JWT Decode

Decodificar JWT inspecciona el header y el payload de un JSON Web Token para depurar flujos de autenticación, caducidad, audiencia y claims personalizados sin salir del navegador. Pega tokens compactos desde DevTools, logs o cabeceras Authorization (se eliminan los prefijos Bearer).

Decodificar no es verificar. El segmento de firma se muestra solo como metadatos: nunca trates exp, roles u otros claims de un token no verificado como autoritativos en lógica de producción. Los JWT cifrados (JWE) y las cadenas de sesión opacas quedan fuera de alcance; esta página se centra en formas JWS compactas.

Los tokens se decodifican en local. Eso reduce el riesgo de pegar credenciales de producción en un decoder de terceros, aunque aún debes evitar máquinas compartidas y pantallas compartidas cuando los tokens estén vivos. Combínalo con el Formateador JSON cuando quieras reformatear un blob de payload copiado.

Buena práctica: confirma algoritmo e emisor en tu biblioteca de autenticación, no aquí. Usa herramientas Base64 para experimentos ad hoc con segmentos, y Generador de Hash solo al comparar digests — no como sustituto de la verificación de firma. Prefiere tokens de corta duración y rota cualquiera que pueda haberse expuesto.

Frequently asked questions

Explore more

• All developer tools

  Browse formatters, converters, encoders, and more.

• Developer tools

  JWT decode, UUID, regex, timestamps, Markdown preview, and everyday helpers.

• Privacy

  How client-side tools handle your data.