JWT Decoder — Analyze & Decode JSON Web Tokens Online
Decode and analyze JSON Web Tokens (JWT) with our JWT Decoder. The tool automatically separates the token into its three parts (header, payload, signature) and displays the decoded content in formatted JSON. Shows the signing algorithm from the header and checks the expiration claim (exp) against the current time. Note: this tool only decodes tokens and does not verify signatures. Verification needs the shared secret (HS*) or the public key (RS*, ES*, PS*) and belongs on the server. All operations are performed locally in your browser.
Related tools
- Punycode Converter Convert international domain names to Punycode and back. IDN converter supporting Unicode domains for DNS compatibility, also several domains at once, line by line.
- Base64 Encoder Base64 encoder and decoder for text and files with drag & drop support. URL-safe encoding and live preview for web development and APIs.
- URL Encoder URL encoder and decoder for query parameters and components. Parse protocol, host, path. Support for encodeURI and encodeURIComponent methods
- HTML Entity Encoder Encode and decode HTML entities. Convert special characters to HTML entity codes and vice versa with support for named and numeric entity references.
Features
- Header Decoding: View algorithm (alg) and token type (typ)
- Payload Extraction: Decode claims and user data
- Expiry Checking: Automatically verify if token has expired
- Syntax Highlighting: Color-coded JSON for better readability
- Signature Display: Show Base64URL-encoded signature
- Client-Side: All processing happens locally in your browser
Important Security Information
- Decoding ≠ Verification: This tool only decodes the JWT. It does NOT verify the signature.
- Never trust unverified tokens: Always verify signatures server-side before using JWT data.
- Sensitive Data: JWTs are Base64-encoded, not encrypted. Anyone can decode them.
- Secret Keys: Never paste secret keys into online tools or client-side code.
For production applications, use proper JWT libraries like jsonwebtoken (Node.js), PyJWT (Python), or firebase/php-jwt (PHP).
JWT Structure
A JWT consists of three Base64URL-encoded parts separated by dots (.):
Header
Contains token metadata:
alg: Algorithm (HS256, RS256...)typ: Token type (JWT)
Payload
Contains the claims:
sub: Subject (user ID)exp: Expiration timeiat: Issued at- Custom claims
Signature
Verifies token integrity:
- HMAC (shared secret) or RSA/ECDSA (public key)
- Not verified by this tool
- Prevents tampering
Useful Resources