JWT Decode

Key takeaways

• Decode header and payload locally
• Shows iat / exp / nbf as ISO times when present
• Signature is not verified
• Tokens are not uploaded

What is a JWT?

A JSON Web Token is a compact, Base64URL-encoded structure (typically header.payload.signature) used to carry claims between parties.

Decoding reads the JSON segments. Verification checks the signature with a key and algorithm. This page only decodes. Never trust exp, roles, or other claims from an unverified token in production logic.

Features

• Header & payload JSON

  Pretty-prints decoded segments with algorithm and claim fields.

• Claim helpers

  Shows issued-at, expiry, and not-before as ISO timestamps when present.

• Bearer prefix tolerant

  Paste Authorization: Bearer … values; the prefix is stripped.

• Private by default

  Tokens stay on your device — never POSTed to a server.

How it works

1. 1

   Paste a JWT

   Use a compact token (header.payload.signature) from logs or DevTools.

2. 2

   Decode

   Base64URL segments are decoded to JSON. Signature bytes are not verified.

3. 3

   Inspect claims

   Review alg, sub, exp, and custom claims in the formatted output.

Example walkthroughs

• Sample HS256-shaped token

  Decodes a classic demo token into header, payload, and signature metadata.

  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

• Issuer and audience claims

  Shows iss, aud, iat, and exp style claims — still display-only; signature is not verified.

  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzQyIiwiYXVkIjoiYXBpLnJzcm9zaGkuZGV2IiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE4MDAwMDAwMDB9.demo-signature-not-verified

Common JWT registered claims

Use cases

• Debug auth failures

  Confirm expiry and audience claims when APIs return 401.

• Inspect SSO cookies

  Read payload fields from session JWTs during local development.

• Document APIs

  Show example claim shapes in internal runbooks.

Code snippets

• Split a compact JWT

  js

  JWT Decode performs this split and pretty-prints header + payload.

  const [header, payload] = token.split(".");
  // decode each Base64URL segment → JSON

Common errors

• Invalid JWT format

  Cause: The token is missing segments or is a JWE / opaque string.

  Fix: Paste a compact JWS with header.payload.signature (two or three parts).

• Claims look trusted but auth still fails

  Cause: This tool does not verify signatures.

  Fix: Validate signatures with your auth library; use decode only for inspection.

About JWT Decode

Decodificar JWT inspeciona o header e o payload de um JSON Web Token para depurar fluxos de auth, expiração, audience e claims personalizados sem sair do navegador. Cole tokens compactos de DevTools, logs ou headers Authorization (prefixos Bearer são removidos).

Decodificar não é verificar. O segmento de assinatura aparece apenas como metadados — nunca trate exp, roles ou outros claims de um token não verificado como autoritativos em lógica de produção. JWTs criptografados (JWE) e strings de sessão opacas estão fora do escopo; esta página foca em formas JWS compactas.

Tokens são decodificados localmente. Isso reduz o risco de colar credenciais de produção em um decoder de terceiros, embora você ainda deva evitar máquinas compartilhadas e compartilhamento de tela quando os tokens estiverem ativos. Combine com o Formatador JSON quando quiser reformatar um blob de payload copiado.

Boa prática: confirme algoritmo e emissor na sua biblioteca de auth, não aqui. Use ferramentas Base64 para experimentos ad hoc com segmentos, e Gerador de Hash só ao comparar digests — não como substituto da verificação de assinatura. Prefira tokens de curta duração e rotacione qualquer um que possa ter sido exposto.

Frequently asked questions

Explore more

• All developer tools

  Browse formatters, converters, encoders, and more.

• Developer tools

  JWT decode, UUID, regex, timestamps, Markdown preview, and everyday helpers.

• Privacy

  How client-side tools handle your data.