JWT Decode

Key takeaways

• Decode header and payload locally
• Shows iat / exp / nbf as ISO times when present
• Signature is not verified
• Tokens are not uploaded

What is a JWT?

A JSON Web Token is a compact, Base64URL-encoded structure (typically header.payload.signature) used to carry claims between parties.

Decoding reads the JSON segments. Verification checks the signature with a key and algorithm. This page only decodes. Never trust exp, roles, or other claims from an unverified token in production logic.

Features

• Header & payload JSON

  Pretty-prints decoded segments with algorithm and claim fields.

• Claim helpers

  Shows issued-at, expiry, and not-before as ISO timestamps when present.

• Bearer prefix tolerant

  Paste Authorization: Bearer … values; the prefix is stripped.

• Private by default

  Tokens stay on your device - never POSTed to a server.

How it works

1. 1

   Paste a JWT

   Use a compact token (header.payload.signature) from logs or DevTools.

2. 2

   Decode

   Base64URL segments are decoded to JSON. Signature bytes are not verified.

3. 3

   Inspect claims

   Review alg, sub, exp, and custom claims in the formatted output.

Example walkthroughs

• Sample HS256-shaped token

  Decodes a classic demo token into header, payload, and signature metadata.

  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

• Issuer and audience claims

  Shows iss, aud, iat, and exp style claims - still display-only; signature is not verified.

  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzQyIiwiYXVkIjoiYXBpLnJzcm9zaGkuZGV2IiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE4MDAwMDAwMDB9.demo-signature-not-verified

Common JWT registered claims

Use cases

• Debug auth failures

  Confirm expiry and audience claims when APIs return 401.

• Inspect SSO cookies

  Read payload fields from session JWTs during local development.

• Document APIs

  Show example claim shapes in internal runbooks.

Code snippets

• Split a compact JWT

  js

  JWT Decode performs this split and pretty-prints header + payload.

  const [header, payload] = token.split(".");
  // decode each Base64URL segment → JSON

Common errors

• Invalid JWT format

  Cause: The token is missing segments or is a JWE / opaque string.

  Fix: Paste a compact JWS with header.payload.signature (two or three parts).

• Claims look trusted but auth still fails

  Cause: This tool does not verify signatures.

  Fix: Validate signatures with your auth library; use decode only for inspection.

About JWT Decode

JWT Decode inspects a JSON Web Token’s header and payload so you can debug auth flows, expiry, audience, and custom claims without leaving the browser. Paste compact tokens from DevTools, logs, or Authorization headers (Bearer prefixes are stripped).

Decoding is not verification. The signature segment is shown as metadata only - never treat exp, roles, or other claims from an unverified token as authoritative in production logic. Encrypted JWTs (JWE) and opaque session strings are out of scope; this page targets compact JWS shapes.

Tokens are decoded locally. That reduces the risk of pasting production credentials into a third-party decoder, though you should still avoid shared machines and screen shares when tokens are live. Pair with JSON Formatter when you want to restyle a copied payload blob.

Best practice: confirm algorithm and issuer expectations in your auth library, not here. Use Base64 tools for ad-hoc segment experiments, and Hash Generator only when comparing digests - not as a substitute for signature verification. Prefer short-lived tokens and rotate anything that may have been exposed.

Frequently asked questions

Explore more

• All developer tools

  Browse formatters, converters, encoders, and more.

• Developer tools

  JWT decode, UUID, regex, timestamps, Markdown preview, and everyday helpers.

• Privacy

  How client-side tools handle your data.