JWT Decoder — Decode Any JWT Token and Inspect Header, Payload & Claims
Paste any JSON Web Token — it starts with "eyJ" — and instantly see the decoded header and payload as formatted JSON. Expiration (exp) and issued-at (iat) fields are automatically converted to readable UTC dates, and expired tokens are flagged with a warning. All decoding happens in your browser using Base64URL; your token is never sent to any server. Supports HS256, RS256, and ES256 tokens.
What Is JWT Decoder?
Paste any JWT (it starts with "eyJ") and see the decoded header and payload as formatted JSON, plus expiration and issued-at times as readable UTC dates. Expired tokens are flagged with a warning.
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIn0.xxx→Header: {"alg":"HS256"}
Payload: {"sub":"user"}When to Use JWT Decoder
Use to inspect what a JWT token contains — check the algorithm, subject, expiration time, issuer, and any custom claims without needing a library or backend.
Only the header and payload are decoded — the signature cannot be verified without the secret key. Never paste production tokens into third-party sites; this tool runs entirely in your browser.
Who Should Use This Tool?
Inspect what claims your authentication server puts in tokens during development and debugging.
Check what the current user's token contains — role, permissions, expiration — without writing decode code.
Verify that OAuth tokens from Auth0, Okta, or Google contain the expected claims and algorithms.
Audit that tokens do not expose sensitive user data in the unencrypted payload.
Key Use Cases
- →Debugging login failures — check if a token is expired or missing expected claims
- →Verifying OAuth tokens — inspect tokens from Auth0, Okta, Google, or Microsoft identity providers
- →Checking signing algorithm — confirm HS256 vs RS256 vs ES256 in the header
- →Security audit — ensure JWTs do not contain sensitive data (passwords, PII) in the payload
- →API development — verify that custom claims (user ID, roles, org ID) are correctly included
How to Use JWT Decoder
- Paste or type your text into the Input Text box.
- The result appears instantly on the right.
- Click Copy to copy the output to your clipboard.
- Click Clear to reset and process new text.
Common Mistakes & Pro Tips
- !Confusing decoding with verification — anyone can decode a JWT; only the key holder can verify the signature
- !Trusting a decoded JWT without verifying it server-side — an attacker can modify the payload if the signature is not checked
- !Using "none" algorithm JWTs in production — the alg:none header bypasses signature verification entirely
- !Pasting real production tokens into third-party tools — use browser console or a local CLI tool for sensitive tokens
Frequently Asked Questions
Everything you need to know about JWT Decoder
Can this tool verify JWT signatures?
+
No — signature verification requires the secret key or public key, which this tool does not accept. This tool only decodes (Base64URL-decodes) the header and payload. Always verify JWTs server-side with your authentication library.
Why does my JWT start with "eyJ"?
+
"eyJ" is the Base64URL encoding of {" — the opening of a JSON object. All JWTs start with a JSON header, so they all start with eyJ when encoded.