JWT Decoder

What is JWT Decoder?

Decode a JSON Web Token (JWT) and inspect its header and payload without sending the token anywhere. Signature verification is not performed (that requires the signing key) — but you see exactly what the token contains, including issuer, audience, expiry, and custom claims. Essential for debugging authentication flows, reviewing tokens during an integration, or understanding a third-party API's token format.

How do I use JWT Decoder?

1. Paste the JWT (three Base64URL segments separated by dots) into the input.
2. The header and payload decode live on the right.
3. Expiry and issued-at timestamps are shown in human-readable form.

JWT Decoder by the numbers

Supported algs

HS256/384/512, RS256/384/512

Verification

Optional; key pasted locally

Privacy

Token never transmitted

Claims parsing

iat, exp, nbf auto-decoded

Copy

Header, payload, or whole token

Common use cases for JWT Decoder

• Debugging a 401 by checking whether a token is expired.
• Confirming a downstream service is reading the right "sub" claim.
• Demonstrating token contents to a teammate during a review.
• Verifying an RS256-signed token against a public key.
• Teaching the JWT structure in a workshop without exposing live tokens.

Common pitfalls and how to avoid them

• Verification fails with the right key — Check the alg header — HS* needs the shared secret, RS* needs the PEM public key. Copy-paste errors are the usual culprit.
• Token decodes but looks tampered — Remember: the header and payload are base64-encoded, not encrypted. Anyone with the token can read them — that is expected.
• Expiry shows the wrong time — exp is Unix seconds, not milliseconds. If you were comparing to Date.now() / 1000, divide correctly.

When should I use JWT Decoder?

JWT Decoder inspects tokens locally. To verify signatures, you need the server's public key — that's typically done in code, not via a tool. For generic Base64 decoding of things that aren't JWTs, use Base64 Decode.