JWT Decoder Online

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token used to securely transmit claims between two parties. JWTs are commonly used for authentication, authorization, APIs, OAuth 2.0, OpenID Connect, and single sign-on (SSO).

What does a JWT contain?

A JWT consists of three parts separated by periods (.): the Header (metadata such as signing algorithm and key ID), the Payload (claims describing the user or token), and the Signature (used to verify the token has not been modified).

What is the difference between decoding and verifying a JWT?

Decoding simply converts the Base64URL-encoded header and payload into readable JSON. Verification checks whether the signature was created using the correct secret or public key. This tool decodes JWTs but does not verify their signatures.

Does this tool verify JWT signatures?

No. Signature verification requires access to the original signing secret (for HMAC algorithms such as HS256) or the public key (for asymmetric algorithms such as RS256 or ES256). For security reasons, those keys should not be entered into a browser-based decoder.

Which JWT algorithms can I inspect?

The decoder can display the algorithm specified in the JWT header, including common values such as HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, and ES512.

What are JWT claims?

Claims are pieces of information stored inside the JWT payload. Common registered claims include: sub (Subject), iss (Issuer), aud (Audience), exp (Expiration time), iat (Issued at), nbf (Not before), and jti (JWT ID). Applications can also include custom claims.

What is Base64URL encoding?

Base64URL is a URL-safe variation of Base64 encoding used by JWTs. It replaces certain characters so tokens can safely be transmitted in URLs and HTTP headers without additional encoding.

Can I modify a JWT?

Yes, you can manually edit the decoded header or payload, but changing the contents invalidates the original signature. A modified JWT must be re-signed using the correct secret or private key before it can be trusted.

Can I tell if a JWT has expired?

Yes. This tool reads the exp (expiration) claim and can help you determine whether the token has expired based on its timestamp.

Why is my JWT invalid?

Common reasons include an incorrect format, invalid Base64URL encoding, missing sections, malformed JSON, expired claims, or an invalid signature. This decoder can help identify formatting issues but does not verify signatures.

Is it safe to paste my JWT here?

All decoding happens locally inside your browser, and your token is never uploaded to a server. However, you should avoid sharing production tokens publicly because they may contain sensitive information or grant access to protected resources.

Can I use this tool offline?

Yes. Once the webpage has loaded, JWT decoding works entirely within your browser and does not require an internet connection.

Which authentication systems use JWTs?

JWTs are commonly used by OAuth 2.0 providers, OpenID Connect identity providers, Auth0, Firebase Authentication, Amazon Cognito, Microsoft Azure Active Directory, Keycloak, Supabase, Clerk, Okta, and many custom authentication systems.

Is my data uploaded to a server?

No. All decoding is performed locally in your browser. Your JWT, claims, and decoded data remain on your device and are never transmitted or stored.

Who should use a JWT Decoder?

This tool is useful for frontend developers, backend developers, API engineers, DevOps teams, QA testers, security professionals, students, and anyone who works with JWT-based authentication or authorization systems.

Why use a JWT Decoder?

A JWT Decoder makes it easy to inspect token contents, understand authentication flows, troubleshoot authorization problems, verify claims, check expiration times, and learn how JSON Web Tokens work — all without writing code or installing additional software.