JWT Decoder

What is a JWT decoder?

A JWT decoder splits a JSON Web Token into its three parts — header, payload, and signature — and Base64URL-decodes the first two so you can read them as JSON. Developers use it constantly while debugging login flows, authorization, session claims, and token expiration problems.

Decoding a JWT is *not* the same as trusting it. The header and payload are readable by design — they are only Base64URL-encoded, not encrypted. Verification is what checks whether the token was signed by the expected party and has not been tampered with.

A JWT looks like header.payload.signature. Each part is Base64URL-encoded, separated by dots. The header says which signing algorithm is used, the payload carries the claims (who the user is, when the token expires, what they're allowed to do), and the signature lets the server prove the token wasn't modified.

What you'll learn while decoding JWTs

• A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature.
• Common claims like sub, role, iat, nbf, and exp describe identity, permissions, issued time, and expiration time.
• A decoded payload can be edited by anyone — only the signature lets a server detect tampering.

How to decode a JWT step by step

1. 1

   Paste the full token

   Paste the JWT into the input box. It should look like xxxx.yyyy.zzzz — three Base64URL-encoded parts joined by dots.

2. 2

   Read the header

   The header tells you the signing algorithm (alg) and token type. Watch out for "alg": "none" — that means the token is unsigned and can't be trusted.

3. 3

   Read the payload claims

   The payload is the JSON with all the claims. Look for sub (user id), exp (expiration), iat (issued at), and any custom claims your app adds like role or tenant.

4. 4

   Check expiration

   Convert the exp Unix timestamp to a date — if it's in the past, the token is expired and any well-behaved API will reject it.

5. 5

   Verify the signature (optional)

   If you have the secret or public key, paste it into the verifier to confirm the signature is valid. The token's contents are only trustworthy when the signature checks out.

Standard JWT claims

These are the registered claims defined by the JWT spec (RFC 7519). Any application can add its own custom claims alongside them.

JWT examples to try

{  "alg": "HS256",  "typ": "JWT"}

{  "sub": "user_123",  "role": "student",  "exp": 1710000000}

{  "exp": 1710000000}

{  "alg": "none",  "typ": "JWT"}

Common JWT mistakes

• Putting passwords, secrets, or sensitive personal data into the payload. JWTs are readable, not encrypted.
• Decoding a token and assuming it is valid without checking the signature.
• Confusing Base64URL readability with encryption — JWT payloads are easy to read on purpose.

JWT FAQ