JWT Decoder
Our JWT decoder lets you paste a JSON Web Token and immediately see what is inside it — the header, the payload, the registered claims, and the expiration time. It is built for developers who are debugging authentication, inspecting access tokens, or learning how JWTs are structured, and it works entirely in your browser.
Decoding a JWT is different from verifying it. This tool reads and displays the token contents so you can understand them; it does not check the cryptographic signature or confirm that the token came from a trusted issuer. Because everything runs locally, your token is never uploaded to a server, which keeps debugging private.
More Free Tools
You Might Also Like
How to Decode a JWT
Paste the JWT into the input field above.
Click "Decode JWT" (or press Enter).
Review the decoded header and payload sections.
Inspect common claims such as issuer, subject, and expiration.
Copy the header, payload, or the full token whenever you need it.
What Is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It is commonly used in web applications for authentication and authorization: after a user logs in, an API may issue a JWT as an access token that the client presents on later requests.
A JWT has three parts separated by dots: a header, a payload, and a signature. The header describes the signing algorithm and token type, the payload carries the claims (the data you care about), and the signature lets the issuer prove the token has not been tampered with. The structure is HEADER.PAYLOAD.SIGNATURE.
It is important to understand that the payload is encoded, not encrypted. Anyone who holds the token can decode and read the header and payload. That is why JWTs should carry only non-sensitive claims and why you should never paste a real production token into shared or untrusted tools.
JWT Header, Payload and Signature
- Header: The header is a JSON object, usually containing alg (the signing algorithm, such as HS256 or RS256) and typ (typically "JWT"). It tells a verifier how the token was signed.
- Payload: The payload is a JSON object holding the claims — the actual data such as the user ID, issuer, and expiration. This is the part you usually want to inspect.
- Signature: The signature is the third segment. It is generated from the header, payload, and a secret or private key. Displaying the signature does not verify it; only the issuer can perform real verification.
Common JWT Claims
- iss (Issuer): Identifies who issued the token, such as an authentication server.
- sub (Subject): Identifies the principal the token is about, often a user ID.
- aud (Audience): Identifies the intended recipient(s) of the token, such as a specific API.
- exp (Expiration): A Unix timestamp after which the token should no longer be accepted.
- iat (Issued at): A Unix timestamp indicating when the token was created.
- nbf (Not valid before): A Unix timestamp before which the token must not be accepted.
- jti (JWT ID): A unique identifier for the token, useful for preventing replay.
How JWT Expiration Works
- Unix timestamps: The exp, iat, and nbf claims are standard Unix timestamps measured in seconds since 1970-01-01 UTC, not milliseconds.
- Checking expiration: A decoder can compare exp to the current time to show whether a token has expired. This is a convenience check only — a non-expired token can still be invalid for many other reasons.
JWT Encoding vs Encryption
- Encoded, not encrypted: JWT segments are Base64URL-encoded so they can travel safely in URLs and headers. Encoding is reversible and provides no confidentiality.
- Reading the payload: Because the payload is only encoded, anyone with the token can read it. Sensitive data should never be placed in a JWT payload.
Common JWT Errors
- Malformed token: A JWT must have exactly three dot-separated segments. "not-a-jwt" or two-part values cannot be decoded.
- Invalid Base64URL: A segment that is not valid Base64URL cannot be turned back into JSON.
- Invalid JSON: If a decoded segment is not valid JSON, the header or payload cannot be parsed.
- Expired token: A token whose exp is in the past will be rejected by APIs, even though it still decodes perfectly.
Is It Safe to Decode a JWT Online?
- Client-side decoding: Decoding does not require sending the token anywhere. This tool performs all decoding in your browser, so the token is not transmitted to EzToolio.
- Be careful with real tokens: Even though decoding is local, you should avoid pasting sensitive production tokens into any tool or sharing them publicly, since the payload may contain identifying information.
Frequently Asked Questions
What is a JWT decoder?
A JWT decoder takes a JSON Web Token, splits it into its header, payload, and signature, and converts the first two parts from Base64URL back into readable JSON. It helps you inspect what a token contains.
Can I decode a JWT without the secret key?
Yes. Decoding the header and payload only requires reversing Base64URL and parsing JSON, which anyone holding the token can do. Decoding is different from verifying the signature, which does require the secret or public key.
Is a JWT payload encrypted?
No. The payload is Base64URL-encoded, not encrypted. Anyone who has the token can decode and read the header and payload, which is why sensitive data should not be placed in a JWT.
What do the three parts of a JWT mean?
They are the header (algorithm and token type), the payload (the claims or data), and the signature (used by the issuer to prove the token has not been tampered with). The format is HEADER.PAYLOAD.SIGNATURE.
How can I tell when a JWT expires?
Look at the exp claim in the payload. It is a Unix timestamp in seconds; a decoder can convert it to a human-readable date and tell you whether it is in the past (expired) or in the future.
Does EzToolio upload my JWT?
No. Decoding happens entirely in your browser using JavaScript, and the token is not sent to EzToolio servers. Still, avoid pasting sensitive production tokens into any tool or sharing them publicly.
Need to pretty-print the decoded JSON? Our JSON Formatter makes it readable in one click.
If you found this tool useful, please share it with others.