JWT Decoder

Decode, inspect, and validate JSON Web Token structure and claims.

Encode & decode

Token Info

Encoded JWT Token

Paste a JWT token in the input above

Click "Decode JWT" to view header & payload

What this tool does

JSON Web Tokens (JWTs) are compact, URL-safe tokens used for stateless authentication in modern web applications. A JWT consists of three Base64URL-encoded segments separated by dots: the header (algorithm and type), the payload (claims), and the signature. This tool decodes and displays all three parts in human-readable form, making it easy to inspect tokens during development and debugging.

The decoder surfaces every claim in the payload, including registered claims like iss (issuer), sub (subject), exp (expiration), iat (issued at), and any custom claims your application adds. It also flags expired tokens based on the exp claim and warns if the alg header is set to none, which is a well-known security vulnerability when used in production.

Usage Example

// Sample JWT structure
// eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

// Decoded header
{
  "alg": "HS256",
  "typ": "JWT"
}

// Decoded payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Common Edge Cases

The alg: none header is a critical security vulnerability. Some legacy libraries accept tokens with this header as valid, allowing attackers to forge tokens without any signature.
Tokens without an exp claim never expire, which is usually a configuration error. Always set a short expiration and refresh tokens on a schedule.
The signature is verified using a secret (HMAC) or public key (RSA/ECDSA). This tool only decodes; it does not verify the signature because it does not have access to the secret.
Clock skew between the issuer and verifier can cause exp or nbf claims to be rejected prematurely. Most libraries allow a leeway of 30-60 seconds.
Base64URL encoding strips trailing = padding and replaces + and / with - and _. Decoders must handle both standard and URL-safe alphabets.

FAQ

Does this tool verify the signature?: No. Decoding only reveals the contents of the header and payload. Signature verification requires the secret or public key used to sign the token, which should never be shared with a client-side tool.
Are JWTs safe to store in localStorage?: Generally no. localStorage is accessible to any JavaScript running on the page, making it vulnerable to XSS attacks. Use httpOnly cookies for authentication tokens, or store the JWT in memory and refresh it on page load.
What is the difference between JWT and opaque tokens?: JWTs are self-contained and can be verified without a database lookup. Opaque tokens are random strings that require a server-side lookup to validate. JWTs are more performant but harder to revoke.