Skip to content
MyDevToolbox

JWT Decoder

Client-side

Inspect a JSON Web Token's header, payload and signature.

Runs 100% in your browser · Inputs are saved only in this browser, if you allow it

Paste a token to decode it.

What is a JSON Web Token?

A JSON Web Token (JWT, defined in RFC 7519) is a compact, URL-safe string used to transfer claims between two parties. It is the most common format for access tokens in OAuth 2.0 and OpenID Connect, and for stateless session tokens in REST APIs. A signed JWT has three base64url-encoded parts separated by dots:

  • Header – the token type and the signing algorithm, for example {"alg":"HS256","typ":"JWT"}.
  • Payload – the claims: who the user is, what they can do and when the token expires.
  • Signature – proof that the header and payload were issued by someone holding the key and have not been modified.

Decoding is not the same as verifying

The header and payload are only encoded, not encrypted: anyone who holds a token can read it. This decoder shows its contents instantly, translates the exp, iat and nbf timestamps into readable dates and tells you whether the token has expired. To trust a token, however, you must also verify its signature. Enter the shared secret for HMAC tokens (HS256, HS384, HS512) or the PEM public key for RSA and ECDSA tokens (RS256, PS256, ES256 and their variants) and the tool checks it using your browser's Web Crypto API.

Private by design

Tokens often grant access to real systems, so everything happens locally in your browser: nothing is sent to our servers. The token you paste is remembered in localStorage for convenience (use Clear Data to remove it), while secrets and keys are never stored at all.

Practical examples

Debug a 401 Unauthorized response

Copy the value of the Authorization: Bearer … header from your browser's network tab and paste it here (the Bearer prefix is removed automatically). Check whether exp is in the past, whether the aud claim matches your API, and whether the iss is the identity provider you expect.

Read a token from the command line

$ echo "$TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null

This works for quick checks, but it does not handle base64url padding or verify anything, which this tool does for you.

Security tips

  • Never put passwords or personal data in a payload: it is readable by anyone.
  • Reject tokens with alg: none and pin the algorithms your server accepts.
  • Keep expirations short and use refresh tokens for long-lived sessions.