JWT Decoder: The Complete Guide to Inspecting JSON Web Tokens

JSON Web Tokens have become the backbone of modern web authentication, but their opaque base64url-encoded strings can be a black box when something goes wrong. Whether you're debugging a failed login, inspecting an API token from a third-party service, or auditing the claims a provider is issuing, you need a fast way to look inside a token without writing throwaway scripts. The JWT Decoder is a free, client-side tool that instantly decodes the header, payload, and signature of any JWT so you can see exactly what's inside.

Unlike backend JWT libraries that bundle verification, signing, and parsing together, a decoder is purpose-built for one job: showing you the contents of a token as quickly as possible. Paste a token, and the tool breaks it into its three segments, decodes the base64url-encoded JSON, and presents the header and payload in a readable, structured format. Because everything runs in your browser, there's no server roundtrip and no risk of your token leaking to a third party.

In this guide, we'll walk through what the JWT Decoder does, how to use it effectively, the internal structure of JWTs, common claims you'll encounter, and practical scenarios where decoding tokens saves you time. By the end, you'll know how to read any JWT like a pro and avoid the security pitfalls that come with handling them.

Why Use JWT Decoder?

• Instant decoding — Paste a token and get the decoded header, payload, and signature segments in milliseconds, with no installation or setup required.
• Algorithm validation — The tool detects and validates the algorithm declared in the token header, supporting HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, and ES512.
• Expiration checking — The exp (expiration) claim is parsed and compared against the current time, so you immediately know whether a token is still valid.
• Clipboard convenience — Copy the decoded header or payload to your clipboard with a single click for pasting into tickets, logs, or documentation.
• Privacy-first — Decoding happens entirely in your browser. Your token never leaves your machine, making it safe for sensitive or production credentials.
• Security-aware — A clear notice reminds you that decoding is not the same as verification: the tool shows you what a token claims, but does not validate its signature.

Key Features

• Reads every segment — The decoder doesn't just show the payload; it gives you the full picture by exposing the header (algorithm and token type), the payload (claims), and the raw signature so you can understand the token end to end.
• Handles edge cases gracefully — Malformed segments, missing claims, and non-standard headers are surfaced clearly rather than causing silent failures, so you always know what you're looking at.
• No account or API key — The tool is completely free with no sign-up, no rate limits, and no usage tracking, making it ideal for quick lookups during development or incident response.

How to Use

1. Copy your JWT — Grab the full token string from your application's Authorization header, a cookie, a configuration file, or wherever it's stored. A typical JWT looks like eyJhbGciOi... followed by two more dot-separated segments.
2. Open the JWT Decoder — Navigate to the JWT Decoder tool. Paste your token into the input field. The decoder accepts the raw token; no formatting or trimming is needed beyond removing surrounding whitespace.
3. Review the decoded output — The tool instantly displays the decoded header (showing the algorithm and token type), the payload (all claims as formatted JSON), and the signature segment. Claims like sub, exp, and iat are highlighted for quick scanning.
4. Check expiration and validity — Look at the exp claim to confirm whether the token is still valid. The tool compares it to the current time and flags expired tokens so you don't have to manually convert Unix timestamps.
5. Copy what you need — Use the copy buttons to grab the header or payload JSON for use in bug reports, API documentation, or team discussions. When you're done, simply close the page — nothing is stored.

Understanding JWT Structure

A JSON Web Token is a compact, URL-safe string consisting of three Base64Url-encoded parts separated by dots: header.payload.signature. Understanding each part is essential for debugging authentication issues and auditing tokens.

Header

The header typically contains two fields: alg, the signing algorithm used (for example, HS256 or RS256), and typ, the token type, which is almost always JWT. Some tokens include a kid (key ID) field that identifies which key was used to sign the token — useful when an issuer rotates between multiple keys.

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

The payload contains the claims — statements about an entity (usually the user) and additional metadata. Claims come in three varieties: registered claims (standardized by the JWT spec), private claims (custom to a specific application), and public claims. Common registered claims include:

• sub (subject) — The principal that is the subject of the token, typically the user ID.
• exp (expiration time) — The time after which the token must no longer be accepted, expressed as a Unix timestamp.
• iat (issued at) — The time the token was issued, useful for determining token age.
• iss (issuer) — The principal that issued the token, often a URL identifying the authorization server.
• aud (audience) — The intended recipient of the token, such as a specific API endpoint or resource server.
• nbf (not before) — The time before which the token must not be accepted, allowing for clock-skew-tolerant activation windows.
• jti (JWT ID) — A unique identifier for the token, used to prevent replay attacks.

Signature

The signature is created by taking the encoded header, the encoded payload, a secret (for HMAC algorithms) or a private key (for RSA or ECDSA), and signing them with the algorithm specified in the header. The signature ensures that the token hasn't been tampered with — but it can only be trusted if you verify it against the correct secret or public key, which the decoder does not do.

Base64Url Encoding

JWTs use Base64Url encoding, a variant of Base64 that replaces + with - and / with _, and omits the = padding characters. This makes tokens safe to include in URLs and HTTP headers without requiring additional escaping. The JWT Decoder handles this encoding transparently, so you see clean JSON output regardless of the input format.

Practical Use Cases

Debugging Authentication

When a user reports "I can't log in," the JWT is often the first place to look. Decoding the token lets you check whether the exp claim has passed, whether the sub matches the expected user, and whether the issuer (iss) and audience (aud) match your application's configuration. A quick decode can reveal that a token expired an hour ago or was issued for the wrong API — issues that would otherwise require digging through server logs.

Inspecting API Tokens

Third-party services often return JWTs as access tokens. Before integrating with an unfamiliar API, decoding the token tells you which claims are available, how long the token lasts, and what scopes or roles are embedded in the payload. This saves you from trial-and-error API calls and helps you design your integration around the actual data the service provides.

Security Auditing

During security reviews, decoding JWTs helps identify misconfigurations: tokens signed with the insecure none algorithm, excessively long expiration times, missing iss or aud claims, or sensitive data (like email addresses or internal IDs) leaking in the payload. While the decoder cannot verify signatures, it reveals exactly what an attacker would see if they intercepted the token, which is the first step in assessing exposure.

Learning JWT Internals

For developers new to JWTs, decoding real tokens is the fastest way to understand the format. Seeing how claims map to JSON fields, how base64url encoding works, and how the three segments fit together builds intuition that reading documentation alone can't provide. The JWT Decoder turns abstract concepts into concrete, inspectable output.

Best Practices

• Never trust claims without signature verification — Decoding shows you what a token claims to say, but anyone can create a token with any payload. Always verify the signature on your server using the issuer's public key or shared secret before acting on the claims.
• Check the exp claim on every request — A decoded token might look valid, but if it has expired, it should be rejected. Implement server-side expiration checks and don't rely solely on client-side validation.
• Validate the algorithm explicitly — Don't accept tokens based on the alg header alone. Some attacks exploit libraries that automatically switch algorithms; always specify the expected algorithm when verifying signatures.
• Keep tokens private — Treat JWTs like passwords. Don't log them, don't put them in URLs where they can leak via referrer headers, and don't share them in screenshots or support tickets without redacting sensitive claims.
• Always use HTTPS — Tokens transmitted over plain HTTP can be intercepted. Enforce HTTPS for any endpoint that sends, receives, or processes JWTs, and consider using the Secure flag on cookies that store tokens.
• Rotate signing keys regularly — Whether you use HMAC secrets or RSA key pairs, rotate them on a schedule and support multiple valid keys simultaneously via the kid header to enable zero-downtime rotation.

Start Decoding Your Tokens Today

Ready to see what's inside your tokens? Head over to the JWT Decoder and paste any JWT to instantly view its header, payload, and signature. It's free, private, and works entirely in your browser — no sign-up, no installation, no data leaving your device. Whether you're debugging an auth flow, auditing a third-party token, or just learning how JWTs work, the decoder is your fastest path from opaque string to readable claims.

Related Tools You Might Like

• JSON Formatter — Beautify, validate, and minify JSON with a clean, readable output for debugging API responses and configuration files.
• UUID Generator — Generate RFC 4122-compliant UUIDs (versions 1, 4, and 5) for database keys, session IDs, and distributed systems.
• JWT Generator — Create signed JWTs for testing and development with custom headers, payloads, and selectable algorithms.

Happy decoding!