JWT Decoder
Decode the Header and Payload of a JWT token; inspect claims, algorithm and validity period.
All processing takes place in your browser. Your token data is not sent to a server.
Enter a JWT token
Paste the JSON Web Token you want to decode into the field below.
Header
Base64UrlPayload
ClaimsSignature
Not verifiedJWT claim information
Fields found in the Payload and descriptions of standard claims.
| Claim | Value | Description |
|---|---|---|
| Claim information will be displayed here once the JWT has been decoded. | ||
JWT Decoder features
The features needed to inspect the JWT token structure, read claim values and evaluate time information are offered on a single page.
JWT Header decoding
Shows Header details such as the algorithm used by the token, the token type and, if present, the key ID.
JWT Payload decoding
Shows the standard and custom claim values in the Payload as readable JSON.
Expiry check
Converts the exp, nbf and iat Unix timestamp values into readable dates.
Claim descriptions
Explains the meaning of standard claim fields such as issuer, subject, audience, expiration and JWT ID.
Quick copy
Copies the decoded Header, Payload or the original token value to the clipboard with a single click.
Secure processing in the browser
JWT decoding is performed on your device and your token content is not sent to a server.
What is JWT Decoder?
JWT Decoder is an online developer tool that decodes the Header and Payload of a token in JSON Web Token format from Base64Url and converts them into readable JSON data.
JWT tokens are widely used for authentication, authorization, user sessions, API access and secure information exchange between systems. Information such as the user identity, roles, permissions, the issuing system and the validity period can be carried in the token as claim fields.
JWT content does not have to be encrypted. The Header and Payload of standard signed JWT tokens are encoded with Base64Url and can be decoded by anyone who obtains the token. For this reason, sensitive information such as passwords, credit card data or confidential personal data should not be carried in the JWT Payload.
How do you use JWT Decoder?
Follow the steps below to decode the contents of a JWT token.
Add the JWT token
Paste the token value you want to decode into the input field.
Decode the token
Click the Decode JWT button to open the Header and Payload content.
Review the claim information
Check the issuer, audience, subject, roles and custom fields.
Check the expiry status
Check whether the token has expired and review its start date.
What sections does a JWT token consist of?
A standard signed JWT token consists of three main sections separated by dots.
HEADER.PAYLOAD.SIGNATUREToken information
Specifies the signing algorithm and the token type. It usually contains the alg and typ fields.
Claim information
Contains standard or application-specific claim values such as user, permissions, issuer, audience and expiry.
Integrity check
The cryptographic signature section created to verify that the Header and Payload data have not been altered.
Common JWT claim fields
The common registered claim fields used in the JWT Payload are described below.
| Claim | Name | Description |
|---|---|---|
iss |
Issuer | Specifies the system or authorization server that created the token. |
sub |
Subject | Specifies the user or resource the token represents. |
aud |
Audience | Specifies the applications or services that are meant to accept the token. |
exp |
Expiration Time | Specifies after which Unix timestamp value the token becomes invalid. |
nbf |
Not Before | Specifies the time before which the token must not be accepted. |
iat |
Issued At | Specifies the time the token was created, as a Unix timestamp. |
jti |
JWT ID | Provides a unique identifier for the token. |
What is the difference between JWT decoding and JWT verification?
Viewing the contents of a JWT and verifying that the token is trustworthy are two different operations.
| Feature | JWT Decoder | JWT Verification |
|---|---|---|
| Main purpose | Viewing the Header and Payload content | Checking the token's signature and trustworthiness |
| Is a secret key required? | No | Depending on the algorithm, a key or public key is required |
| Claim viewing | ✔ Supported | ✔ Supported |
| Signature verification | ✘ Not performed | ✔ Performed |
| Can it be used for authorization? | Cannot be used on its own | Can be used together with all required security checks |
iss, aud, exp and nbf checks must be performed on the server side with a trusted JWT library.
Where is JWT Decoder used?
JWT decoding tools are used to inspect token content in authentication, API development, integration and debugging processes.
API debugging
Check the user, role and permission claims in the access token used in an API request.
Token expiry check
Check via the exp claim whether an access token or ID token has expired.
OAuth and OpenID Connect
View the claim content of JWT-format tokens generated in OAuth 2.0 and OpenID Connect flows.
Role and permission review
Check whether application-specific role, permission or scope claims appear correctly in the token.
Issuer and audience check
Review the system that created the token and the API or application the token is intended for.
Integration tests
Verify that the expected claims are passed in the token generation process between the identity provider and the application.
Frequently Asked Questions About JWT Decoder
Read the answers to frequently asked questions about JWT decoding, claim fields, token expiry and signature verification.
What is JWT Decoder used for?
Is decoding a JWT token safe?
Does JWT Decoder verify the token signature?
Is a JWT token encrypted?
Can JWT content be modified?
How can I tell whether a JWT token has expired?
exp claim in the Payload states the token's expiry time as a Unix timestamp. If this value is earlier than the current time, the token has expired.
What do exp, iat and nbf in a JWT mean?
exp states the token's expiry time, iat its creation time, and nbf the time before which the token must not be used.
Can sensitive data be stored in a JWT Payload?
Why can't an invalid JWT token be decoded?
What is the difference between JWT and JWE?
Is JWT Decoder free?
Free Developer Tools
Free online tools you can use in software development, API integration, data conversion, testing and productivity workflows.