A JSON Web Token is a compact, URL-safe token format with three Base64Url-encoded parts separated by dots: a header (algorithm and type), a payload (claims like user ID and expiry), and a signature that lets servers verify the token wasn't altered.

Is it safe to decode a JWT online?

This decoder runs entirely in your browser — the token is never sent to any server. Still, treat production tokens as secrets: anyone holding a valid token can use it, so avoid pasting live production tokens into any third-party site.

Why can I read a JWT without the secret key?

JWT payloads are encoded, not encrypted. Base64Url encoding is trivially reversible by design — the signature only proves integrity and authenticity, not confidentiality. Never put passwords or sensitive data in a JWT payload.

What are the standard JWT claims?

iss (issuer), sub (subject/user), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (unique token ID). exp and iat are Unix timestamps in seconds.

What is the difference between HS256 and RS256?

HS256 uses one shared secret for both signing and verification — simple but the secret must be shared with every verifier. RS256 uses a private key to sign and a public key to verify, so services can verify tokens without being able to forge them. RS256 is preferred for multi-service architectures.

JWT Decoder — Free Online JSON Web Token Decoder

Remove Ads

Share on Social Media:

JWT Decoder — Inspect JSON Web Tokens Instantly and Privately

Every modern API debugging session eventually reaches the same question: what is actually inside this token? This free JWT decoder splits any JSON Web Token into its header, payload, and signature, pretty-prints the JSON, converts Unix timestamps to readable dates, and flags expired tokens — all locally in your browser. The token never touches a server, which matters when you're holding real credentials.

Anatomy of a JWT

A JWT is three Base64Url segments joined by dots: xxxxx.yyyyy.zzzzz

Header — typically {"alg":"HS256","typ":"JWT"}: the signing algorithm and token type.
Payload — the claims: who the token is for, who issued it, and when it expires.
Signature — a cryptographic MAC or signature over header.payload that verifiers check against their key.

Because the first two segments are plain Base64Url, anyone can read them without any key. The signature prevents tampering, not reading — a distinction that trips up even experienced developers. Sensitive data belongs in the database, referenced by ID, never in the payload itself.

Standard Claims Cheat Sheet

Claim	Meaning	Format
iss	Issuer — who created the token	string/URL
sub	Subject — usually the user ID	string
aud	Audience — intended recipient	string/array
exp	Expiration time	Unix seconds
iat	Issued at	Unix seconds
nbf	Not valid before	Unix seconds
jti	Unique token ID (revocation support)	string

Debugging Common JWT Failures

401 with a "valid-looking" token: decode it and check exp first — expired tokens are the #1 cause. Second most common: the aud claim doesn't match what the API expects.

Signature verification failed: confirm the alg in the header matches what the server verifies with. A server expecting RS256 will reject HS256 tokens — and should, since alg-confusion attacks exploit servers that accept whatever algorithm the token declares.

Clock skew: if tokens fail immediately after issuance, the verifier's clock may be behind the issuer's. Most libraries accept a leeway parameter of 30–60 seconds.

Security Notes Worth Remembering

Keep access tokens short-lived (5–15 minutes) and pair them with refresh tokens.
Never accept "alg":"none" in production verifiers.
Store tokens in httpOnly cookies where possible — localStorage is readable by any injected script.
This tool decodes but deliberately does not verify signatures, because verification requires your secret key — which should never be pasted into any website.

Free and In-Browser

No signup, no rate limits, no network calls with your token. Decode as many JWTs as you need during development and API debugging.

Jwt Decoder

Result