JWT Decoder

What Is a JSON Web Token (JWT)?

A JSON Web Token is a compact, URL-safe string used to securely transmit claims between two parties. It is the dominant authentication mechanism for REST APIs, single-page applications, and microservices. When you log in to a web app, the server typically returns a JWT — your browser stores it and sends it with every subsequent request to prove your identity.

A JWT has three parts separated by dots:

• Header — base64url-encoded JSON declaring the token type (JWT) and signing algorithm (HS256, RS256, etc.)
• Payload — base64url-encoded JSON containing the claims: user ID, email, roles, expiry time, issuer.
• Signature — a cryptographic signature that proves the token was issued by a trusted party and has not been tampered with.

How to Decode and Inspect a JWT

1. Paste your JWT into the input field — it looks like three base64url strings joined by dots.
2. The header and payload are decoded and displayed immediately.
3. Check the exp claim to see when the token expires (shown as a human-readable date).
4. Check the alg field in the header — ensure it is not none, which would mean no signature verification.
5. Look at the payload claims: sub (subject / user ID), iss (issuer), aud (audience), iat (issued at), exp (expires).

This tool decodes the token client-side only — the JWT never leaves your browser. This is important for security: never paste production tokens into online tools that make server requests.

Standard JWT Claims Reference

Any additional fields in the payload are custom claims — role, email, permissions, tenant, etc. These are application-defined.

Common JWT Debugging Scenarios

• 401 Unauthorized on every request — decode the token and check exp. If it is in the past, the token has expired and needs to be refreshed.
• Wrong user permissions — check the roles or permissions claims in the payload. The token may have been issued before a permission change.
• Signature verification failing — check alg in the header. An alg: none token has no signature and should be rejected by any secure server.
• Token issued for wrong audience — check aud claim. Tokens from one service should not be accepted by another service without explicit validation.
• Clock skew errors — if the server rejects a freshly issued token, there may be a clock difference between services. The nbf and exp claims use absolute timestamps.

Authentication and Security Workflow

JWT decoding is part of a broader authentication debugging workflow:

• Format the decoded JSON payload for readable inspection
• Validate the JSON structure of the payload
• Decode Base64url segments — JWT parts are Base64url-encoded strings
• Generate HMAC hashes to understand the JWT signing process
• Convert the exp and iat timestamps from Unix epoch to readable dates

Related Tools

• Analyzing JWT claims in bulk? Export the payload JSON to CSV for spreadsheet analysis. → export JWT claims data to CSV
• Got many JWT payloads to audit? Decode each and export the claims JSON to CSV. → export decoded claims to a spreadsheet
• Writing authentication documentation? Convert your Markdown JWT guide to HTML. → document JWT authentication flows
• Passing a JWT token as a URL parameter? URL-encode it to handle the periods and equals signs safely. → URL-encode JWT tokens for HTTP requests
• Migrating JWT parsing code from VB.NET to C#? Use the VB.NET to C# Converter. → convert VB.NET JWT parsing to C#