JWT Decoder Online: Decode & Debug JSON Web Tokens
JWT decoder online: decode and debug JSON Web Tokens with header, payload, and signature inspection for OAuth and SSO flows.
Updated 2026-08-26
Related Tools
Base64 Encoder/Decoder: Encode & Decode Text Online
JSON Formatter: Beautify, Validate & Minify JSON Online
Hash Calculator: MD5, SHA-256 & 25+ Algorithms Online
ASCII Converter: Encode, Decode & View ASCII Table
Text to Binary Converter: Encode & Decode Binary Online
Charset Detector: Detect File Encoding & Fix Garbled Text
Features
- Decode JWT header, payload, and signature instantly
- Inspect registered claims with human-readable timestamps
- Security warnings: expired tokens, missing exp, alg: none
- Pretty-printed JSON for header and payload
- Signature shown in hex bytes
- Claim badges for common registered claims: iss, sub, aud, exp, iat, nbf with readable timestamps
- Parses JWS tokens (header.payload.signature): tokens with the wrong segment count show a clear parse error
- Copy header, payload, or signature individually with one click
How to Use
- 1Paste your JWT token (header.payload.signature) into the input area. Parsing happens automatically.
- 2Review the decoded header and payload JSON, claims summary, and signature bytes.
- 3Check warnings for security issues like expired tokens or weak algorithms.
- 4Examine the claims summary table to see each registered claim's value and whether the token is currently valid, expired, or not yet active.
- 5Copy individual segments (header, payload, or signature) using the copy buttons next to each section.
- 6Use the pretty-printed JSON view to inspect the full structure of the header and payload.
- 7Check the signature hex bytes to confirm the signature segment is present and decodes correctly.
- 8Test with sample tokens from your development environment to validate your JWT implementation.
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: header (algorithm & token type), payload (claims/data), and signature (cryptographic verification). JWTs are commonly used for API authentication (OAuth 2.0, OpenID Connect).
Is it safe to paste my JWT into this tool?
Yes. All parsing happens locally in your browser via JavaScript; the token is not uploaded to any server.
Does decoding a JWT mean it's authentic?
No. Decoding a JWT only reads its contents: the header and payload are Base64URL-encoded, not encrypted. Anyone can decode a JWT. To verify authenticity, you must check the signature using the issuer's secret or public key. This tool helps you inspect the contents, but signature verification should be done server-side.
What do exp, iat, and nbf mean?
exp (expiration): the token expires after this timestamp. iat (issued at): when the token was issued. nbf (not before): the token is not valid before this timestamp. This tool converts these Unix timestamps to human-readable dates and warns if the token is expired or not yet valid.
What does alg: none mean?
alg: "none" means the JWT has no signature: the third part is empty. This is a security risk because anyone can forge a token with arbitrary claims. Always reject tokens with alg: none in production.
How do I verify a JWT signature?
This tool decodes and displays JWT contents but does NOT verify signatures. To verify a JWT, you need: (1) the token's header (alg, kid), (2) the payload claims, (3) the token's signature, and (4) the issuer's public key (for RS/ES algorithms) or secret (for HS algorithms). Use your backend library: jsonwebtoken (Node.js), PyJWT (Python), or your framework's built-in JWT middleware. Never trust decoded JWTs without signature verification.
How do I decode a JWT without the secret?
JWT header and payload are Base64URL-encoded, not encrypted. You can decode them without the secret; just paste the token and view the decoded JSON. However, decoding does NOT verify authenticity. Only the signature verification (which requires the secret or public key) confirms the token was issued by a trusted source.
What is the difference between JWT, JWS, and JWE?
JWT (JSON Web Token) is the umbrella standard. JWS (JSON Web Signature) is a signed JWT, the most common type, with a cryptographic signature in the third segment. JWE (JSON Web Encryption) is an encrypted JWT where the payload is encrypted. This parser handles JWS tokens only; a JWE token has five segments and will show a parse error. Most JWTs you encounter in OAuth 2.0 and OpenID Connect are JWS tokens.
What is the 'kid' field in the header?
kid (Key ID) is an optional header parameter that hints which key was used to sign the token. It is used when the issuer rotates keys or has multiple signing keys. Your verification library uses the kid to look up the correct public key from a JWKS (JSON Web Key Set) endpoint. Without a matching kid, the issuer may reject your verification attempt.
Can I use this tool to debug OAuth 2.0 / OpenID Connect tokens?
Yes. This tool is excellent for inspecting ID tokens and access tokens from OAuth 2.0 / OpenID Connect providers like Google, Auth0, Keycloak, and Azure AD. Decode them to verify claims like iss (issuer), aud (audience), sub (subject), email, and expiration times during development and debugging.
What does 'iat' and 'nbf' mean for token validity?
iat (Issued At): when the token was created. This is informational: the token is valid from this time. nbf (Not Before): the token should not be accepted before this time. Together with exp (Expiration), these define the token's valid time window. A properly configured server checks: current_time >= nbf AND current_time < exp. This tool shows human-readable dates and warns if the token is outside its validity window.
Why doesn't this tool verify my JWT signature?
Signature verification needs the issuer's secret (HS256) or public key (RS256, ES256), and the key must never be exposed in a browser page: anyone could read it from the source. That is why verification belongs in your backend: jsonwebtoken (Node.js), PyJWT (Python), or your framework's middleware. This tool decodes and displays the three segments so you can inspect claims, expiry, and algorithm, but it cannot and should not verify authenticity.
Why does my token show a parse error or decode as garbage?
A valid JWT has 3 dot-separated segments (header.payload.signature). Common causes of parse errors: the value is not a JWT at all (many OAuth 2.0 access tokens are random opaque strings), the token contains line breaks or surrounding quotes from copying, or it was URL-encoded twice. Strip whitespace and quotes, paste the raw token, and check that it has exactly two dots.
Why does jwt decode online show the expiration as a number instead of a date?
JWT stores time claims like exp, iat, and nbf as Unix timestamps (seconds since 1970-01-01), so the raw payload JSON always shows a number. Any jwt decode tool (this one included) converts them to readable dates in a summary view, but if you copy the raw payload you get the number. Multiply it by 1000 to build a JavaScript Date, or use a Unix timestamp converter.
Why does jwt decode show my token as expired when the app still lets me in?
Several reasons: the server may allow clock skew (typically 30-60 seconds), your app may use refresh tokens or a sliding session so the access token can expire without logging you out, or your device clock is wrong. Compare the exp claim to the current UTC time; token expiry is always judged against UTC.