JWT Decoder
Decode JSON Web Tokens (JWT) to view header and payload claims instantly - optional HS256 signature verification.
How It Works
A JWT has three dot-separated parts: header, payload, and signature. The header and payload are base64url-encoded JSON objects.
This tool decodes those two JSON parts into readable text so you can inspect claims and debug authentication flows quickly.
If the JWT uses HS256, you can optionally verify the signature by computing an HMAC SHA-256 signature locally and comparing it to the token’s signature.
- Header: Contains metadata like alg (algorithm) and typ (token type).
- Payload: Contains claims like sub, iat, exp, roles, and custom fields.
- Signature: Used to detect tampering; HS256 can be verified with a shared secret.
When to Use a JWT Decoder
JWT decoding is helpful when your API rejects requests, a session expires too early, or you need to confirm which claims are being issued by your auth provider.
It’s also useful for quickly validating that a token includes the expected roles, scopes, or tenant identifiers before shipping changes.
- API debugging: Inspect Bearer tokens sent in Authorization headers.
- Auth troubleshooting: Check exp/iat and confirm claim contents.
- Documentation: Copy decoded JSON into bug reports or team docs.
FAQ
Does this JWT decoder upload my token?
No. Decoding happens locally in your browser and nothing is uploaded or stored.
Can it verify JWT signatures?
Yes, optionally for HS256 tokens. Enter the shared secret to verify the signature. Other algorithms are decoded but not verified.
Why does my token show an error?
JWTs must have three parts separated by dots and use base64url-encoded JSON for header and payload. If either part isn’t valid JSON, decoding will fail.
Is decoding the same as verifying?
No. Decoding reads the data inside the token. Verification checks that the signature matches and the token hasn’t been tampered with.
What claims should I look for?
Common ones include exp (expiry), iat (issued at), sub (subject/user id), aud (audience), iss (issuer), and custom app-specific claims.