JWT Decoder

How to Use

1. 1Paste a JWT token into the input box
2. 2Review the decoded header and payload immediately
3. 3Check the timestamp fields, validity warning, and signature section
4. 4Copy any raw or decoded section you need for debugging

Features

• Decodes JWT header and payload locally in the browser
• Shows raw token parts plus parsed JSON sections
• Displays expiration, issued-at, and not-before times in human-readable form
• Flags expired or not-yet-valid tokens
• Copy controls for header, payload, and signature values

Worked example: why is this API returning 401?

• Paste the Authorization: Bearer <token> value into the decoder
• Header shows {"alg": "HS256"} — expected for your backend
• Payload shows "exp": 1756000000, rendered as a human-readable date — it expired yesterday, so the 401 is correct
• Fix: refresh the token; re-decode to confirm the new exp is in the future

What decoding proves (and doesn't)

Base64URL decoding reveals the token's claims but verifies nothing — anyone can craft a JWT. Signature verification happens server-side with the secret or public key. Never paste production tokens into tools you don't trust; this one decodes locally, but treat every decoded claim as unverified until your server validates the signature.

Real-World Use Cases

• Debugging JWT tokens during API development
• Inspecting token claims and expiration
• Verifying token contents during authentication flow
• Educational use for learning JWT structure
• Troubleshooting token-based authentication issues

Best Practices

• Always verify the token signature on the server side — decoding is for inspection only
• Check the exp claim to ensure the token hasn't expired
• Never share tokens containing sensitive personal information
• Use this tool for debugging, never for production token validation
• Understand the difference between header, payload, and signature sections

Common Mistakes to Avoid

• Assuming JWT decoding means the token is verified (it doesn't verify signatures)
• Sharing sensitive tokens in screenshots or logs
• Not checking the expiration (exp) claim
• Confusing encoding with encryption (JWTs are not encrypted by default)
• Using decoded header values for security decisions without signature verification

Troubleshooting

• If the token won't decode, check that it's a valid JWT format (three base64url segments)
• For malformed tokens, verify you copied the complete token including all segments
• If claims seem wrong, the token may be signed with a different algorithm
• Check for trailing whitespace or line breaks in the pasted token
• Verify the token isn't actually an opaque access token instead of a JWT