JWT Decoder
Decode a JWT and inspect its header and payload (no verification).
Was this tool helpful?
Thanks for the feedback!
The JWT Decoder splits a JSON Web Token into its parts and shows the header and payload as formatted JSON, so you can see which algorithm signed it, who it was issued to and when it expires. It is a debugging aid for developers working with login systems, OAuth providers and APIs. It does not check the signature.
Anatomy of a token
A JWT (RFC 7519) is three Base64URL-encoded sections joined by dots: header.payload.signature. Both the header and payload usually begin with eyJ, the encoded form of an opening {" followed by a key name. Decoding a sample token gives:
HEADER:
{
"alg": "HS256",
"typ": "JWT"
}
PAYLOAD:
{
"sub": "user_1024",
"name": "Asha Verma",
"role": "editor",
"iat": 1758787200,
"exp": 1758790800
}The third section, the signature, is ignored. A token without it (just header.payload) still decodes.
Reading the standard claims
| Claim | Meaning |
|---|---|
iss | Issuer, the service that created the token |
sub | Subject, usually the user ID |
aud | Audience, the API the token is meant for |
exp | Expiry time |
nbf | Not valid before this time |
iat | Issued-at time |
jti | Unique token ID |
Times are Unix timestamps in seconds and are shown as raw numbers. In the example, iat 1758787200 is 25 September 2025, 08:00 UTC (1:30 pm IST), and exp 1758790800 is exactly one hour later. The Unix Timestamp Converter turns these into dates. A "token expired" error from an API is often explained by comparing exp with the current time, or by a server clock that is out of sync.
Decoding is not verifying
Anyone can create a token with any payload; only the signature proves it came from the real issuer and wasn't altered. Your server must verify it with the secret (for HS256) or the issuer's public key (for RS256 or ES256) before trusting any claim, and must reject tokens whose header says "alg": "none". Likewise, the payload is only encoded, not encrypted, so never put passwords, Aadhaar numbers or other secrets in it.
Errors and how to fix them
- "Not a JWT" means the input has no dot, so it has fewer than two parts.
- "Invalid character" usually means you copied the
Bearerprefix from an Authorization header. Paste only the token. - "URI malformed" or a JSON error appears for encrypted tokens (JWE, with five parts), whose second part is ciphertext rather than JSON.
A live token works like a password until it expires. Decoding here happens entirely in your browser, but prefer expired or test tokens when you only need to see the structure. To decode a single Base64 segment by hand, see the Base64 Decoder.