What is the JWT Decoder?
JSON Web Tokens are the backbone of modern authentication — every login to your app mints one, and every API call carries one. But a JWT is just three base64 segments joined by dots, opaque to anyone who can't decode it on the spot. When a token mysteriously fails, you need to see inside: is it expired, is the audience wrong, did the issuer change? This decoder splits any token into its header and payload and pretty-prints every claim — exp, iat, iss, aud, sub — so you can diagnose auth failures in seconds instead of guessing.
The decoder runs 100% in your browser — paste tokens from your app, logs, or devtools without sending them to any server. Header and payload decode instantly into readable, syntax-highlighted JSON with every standard claim laid out, so you can compare a working token against a failing one and spot the difference immediately.
How to use it
- Paste your token — Copy the full JWT (the three dot-separated segments) from your app, logs, or browser devtools into the input field.
- View the decoded parts — The header and payload decode instantly into readable, syntax-highlighted JSON below the input.
- Check the claims — Read exp (expiry), iat (issued at), iss (issuer), aud (audience), and sub (subject) to verify the token's validity.
- Spot problems — Expired timestamps, mismatched audiences, or missing claims are easy to catch when the payload is laid out clearly.
- Compare tokens — Decode a working token and a failing one side by side to isolate exactly which claim differs.
Common use cases
- Debug '401 Unauthorized' errors by checking whether the token is expired or has the wrong audience.
- Verify that your auth server issues the expected claims and roles before shipping to production.
- Inspect tokens during OAuth and SSO integrations to confirm issuer and scope configuration.
- Teach JWT structure to junior developers by showing the real anatomy of a live token.
Tips
- Remember the payload is only base64-encoded, not encrypted — never put secrets or PII in JWT claims.
- Convert exp timestamps with a timestamp converter to see expiry in human-readable time.
- Signature verification needs your secret key and belongs server-side; this tool decodes structure only.
- Revoke and rotate tokens immediately if you paste a production token into any third-party tool.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe string of three base64 segments — header, payload, and signature — used to securely transmit claims like user identity between parties.
Does this tool verify the signature?
No. It decodes and displays the header and payload structure. Signature verification requires your secret or public key and must happen on your own server.
Is it safe to paste my token here?
Decoding runs entirely in your browser, so the token never leaves your device. Still, avoid pasting live production tokens anywhere outside your own infrastructure.
Why is my token invalid?
Paste it here and check: malformed tokens show a decode error, while valid-looking ones may be expired (exp in the past) or issued for a different audience.