JWT Decoder

What is JWT Decoder?

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. JWTs consist of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims about the user and metadata), and a signature (for verification). JWTs are stateless and self-contained, making them popular for distributed authentication systems.

Common Use Cases

• Debugging authentication issues - inspect token contents to understand authentication state
• API development - verify JWT structure and claims during API integration
• Security auditing - review token claims and expiration times
• Learning JWT structure - understand how JWTs are constructed
• Token validation - check token format before server-side verification
• Troubleshooting auth flows - decode tokens to see what data is being transmitted
• Development testing - inspect tokens during application development

How It Works

The JWT decoder splits the token into its three parts (header.payload.signature) and decodes the Base64URL-encoded header and payload. The header contains metadata about the token (algorithm, type), and the payload contains claims (issuer, subject, expiration, custom data). The signature is displayed but not verified (verification requires the secret key and must be done server-side). The tool formats the JSON for easy reading and highlights important claims like expiration times.

Examples

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header: {alg: HS256, typ: JWT}, Payload: {sub: 1234567890, name: John Doe, iat: 1516239022}