🎫

JWT Decoder

Decode JSON Web Tokens instantly. View header, payload, and signature. Debug authentication issues, inspect claims, verify token structure. 100% browser-based—tokens never sent to server.

🔍 Instant Decoding 🔒 100% Private 📋 Copy Components
Paste your token below
💡

Sample JWT Token - Click to Try

Test the decoder with this example token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE3MTYyMzkwMjIsImVtYWlsIjoiam9obmRvZUBleGFtcGxlLmNvbSIsInJvbGUiOiJhZG1pbiJ9.8DPqqWqjN9FULzNkH-7MH7Q1U2Jy4bBc5j8Uw2TXCq0

🎫 JWT Structure

JWT tokens have 3 parts separated by dots (.):

header.payload.signature
  • Header: Algorithm & token type
  • Payload: Claims (user data)
  • Signature: Verification hash

💡 Common Claims

  • sub: Subject (user ID)
  • iss: Issuer
  • aud: Audience
  • exp: Expiration time
  • iat: Issued at time
  • nbf: Not before time

JWT Decoder Use Cases

🔍 Debug JWT Authentication Issues

Getting "Unauthorized 401" errors? Decode your JWT to check if it's expired (exp claim), issued by wrong server (iss), or missing required claims. See exactly what your token contains without server logs.

👤 View JWT User Claims

Curious what data your JWT stores? Decode to see user ID (sub), email, roles, permissions. API returning wrong data? Check if your token has correct user info before blaming the backend.

⏰ Check JWT Expiration Time

Token expired? Decode to see exp timestamp. Convert Unix timestamp to readable date. Know exactly when your token expires without making API calls. Perfect for debugging session timeout issues.

🔐 Inspect OAuth Token Structure

OAuth providers (Google, Auth0, Okta) return JWTs. Decode to see scopes, audience, issuer. Verify you're getting correct permissions and claims from identity provider.

🛠️ Test API Integration

Building API? Decode JWTs from Postman/curl requests to verify your auth server generates correct tokens. Check algorithm (alg), issuer (iss), and custom claims before deploying.

📱 Mobile App Token Debugging

App login broken? Copy JWT from device storage/network inspector, decode to see if token format is correct, claims are present, and signature exists. Faster than backend debugging.

Understanding JWT Tokens

How JWT Authentication Works

  1. User logs in with credentials (email/password)
  2. Server verifies credentials and generates JWT
  3. JWT contains user data (claims) and signature
  4. Client stores JWT (localStorage, cookies)
  5. Client sends JWT in Authorization header for API requests
  6. Server verifies signature and grants access

Important Security Notes

  • ⚠️ JWT payload is NOT encrypted - anyone can decode it
  • ✅ Don't store sensitive data in JWT (passwords, credit cards)
  • ✅ Signature prevents tampering - can't modify without secret key
  • ✅ Always use HTTPS to prevent token interception
  • ✅ Set short expiration (exp) for security
Copied!