JWT Decoder

What is JWT

JWT (JSON Web Token) is a compact, URL-safe token format for securely transmitting claims between parties. It's widely used for stateless authentication and authorization — the server issues a token without storing sessions, and the client includes it with each request for identity verification.

Structure: Header.Payload.Signature

Part	Content	Encoding
Header	Algorithm type {"alg":"HS256","typ":"JWT"}	Base64URL
Payload	Claims: iss sub exp iat + custom fields	Base64URL
Signature	HMAC(header + "." + payload, secret)	Raw bytes

The Payload is Base64-encoded, not encrypted — anyone can decode it. Never store passwords or sensitive data in it.

Common Claims

exp expiration time · iat issued at · sub subject · iss issuer · nbf not before · aud audience · jti unique identifier

Common Signing Algorithms

Algorithm	Type	Notes
HS256	Symmetric	HMAC + SHA-256, suitable for single services
RS256	Asymmetric	RSA + SHA-256, ideal for microservices/third-party verification
ES256	Asymmetric	ECDSA + SHA-256, shorter keys, better performance

Common Use Cases

• API auth debugging: Decode tokens to inspect user IDs, roles, permissions, and expiry times
• Troubleshooting: Check if a token is expired (exp), issuer is correct (iss), or algorithm matches
• Security auditing: Confirm tokens don't contain sensitive data and claims are configured properly
• Development testing: Quickly inspect token contents during frontend-backend integration without writing decode logic

How to Use

1. Paste the complete JWT string into the input field (a three-part string starting with eyJ)
2. The tool automatically decodes and displays the Header and Payload as formatted JSON
3. View human-readable expiration times and token status (valid / expired / not yet active)

FAQ

Does decoding a JWT require a secret key?

No. The Header and Payload are simply Base64URL-encoded — anyone can decode and read them. The secret key is only needed to verify the signature (confirm the token hasn't been tampered with). This tool focuses on decoding, not signature verification.

The token shows as expired but my API still accepts it?

Possible causes: the server has clock skew tolerance configured, a Refresh Token is automatically renewing access, or the server isn't properly validating the exp field. Check server-side logs to confirm the actual validation logic.

What does alg: "none" mean?

It indicates an unsigned JWT. This is a known security vulnerability — attackers may change alg to none to bypass signature verification. Production environments must explicitly reject the none algorithm on the server side.