JWT Decoder

Anatomy of a JWT

A JSON Web Token is three Base64URL strings joined by dots: header.payload.signature. The header names the signing algorithm (alg), the type (typ) and often a key ID (kid) that tells the receiver which key to fetch from a JWKS endpoint. The payload carries claims: registered ones such as iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at) and jti (token ID), plus whatever the identity provider adds, like roles or scopes. The signature covers the first two segments.

The important point is that the header and payload are encoded, not encrypted. Anyone holding the token can read them, which is exactly what this decoder does. Encrypted tokens (JWE) have five segments instead of three; for those only the protected header can be shown, because the payload needs the recipient’s private key.

Reading a token

Paste the token into the input pane. Surrounding quotes, a Bearer prefix and even a full Authorization: Bearer ... header line are stripped before decoding, so you can copy straight from browser dev tools or a log line. The output is a single JSON document with header, payload and signature keys, indented with the toolbar’s Indent setting; switch to the Tree view to fold large payloads.

The info panel interprets what the raw JSON does not say plainly. Algorithm gets a name (HS256 is “HMAC with SHA-256”, RS256 is “RSA PKCS#1 v1.5 with SHA-256”), iat, nbf and exp become UTC timestamps with a relative note such as “expires in 3 hours”, and Status reads Valid, Expired, Not yet valid or Valid (no expiry). The Signature row says Not verified until you supply a key. Copy the decoded JSON with Ctrl/Cmd+Shift+C.

Checking the signature

Decoding never needs a key. To go further, fill in Verify with secret or public key (optional). It accepts three kinds of key:

• An HMAC secret for HS256, HS384 and HS512 tokens, typed exactly as the issuing service stores it.
• A PEM public key or certificate (-----BEGIN PUBLIC KEY-----) for RS, PS, ES and EdDSA algorithms.
• A JWK as JSON, for example one entry copied from an identity provider’s /.well-known/jwks.json.

The check is done by jose, the same library many Node and edge back ends use, and the result appears both as a diagnostic and in the Signature row: Verified, or Invalid with the reason. A key whose type does not fit the header’s alg is reported as a mismatch rather than a bad signature. Tokens and keys are processed locally in the page and are not sent anywhere, which matters when the token grants access to a live system.

Warnings it raises

Beyond decoding, the tool flags tokens that would surprise a server. An exp in the past produces a warning with the exact expiry time; a future nbf says when the token becomes usable; an iat ahead of the current time points at clock skew on the issuer. If exp or iat looks like milliseconds instead of seconds, you are told to divide by 1000, a common bug in hand-rolled token code. A header with "alg": "none" is called out as unsecured, since anyone can forge such a token, and an empty signature segment is reported too.

Remember that a token decoding cleanly proves nothing about who issued it. Your API must verify the signature and check exp, aud and iss on every request, and nothing confidential belongs in a payload that any client can read.

Examples

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMjYtMDkta2V5In0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c3JfNDIiLCJhdWQiOiJvcmRlcnMtYXBpIiwic2NvcGUiOiJvcmRlcnM6cmVhZCBvcmRlcnM6d3JpdGUiLCJpYXQiOjE3ODk0NzUyMDAsImV4cCI6NDEwMjQ0NDgwMH0.UmxJEapoJr6JuE5ieJlzYDoWVCzImtWEI3rtaTN7E4MU_7tsehGbYCg8XZyrZ5E0EDgMe--t9OohnyMnqCAHMWZeSebw897wsF2RN6XWp7FaoxXvjmwSLE0UKJHmxMM9BKUxv6xWdiOWxgLEWva67ItKWEvPWxUZ-BwGKxznjAEjbMd9jYwldCDdPmLalRkveCX9O8POquOK1R2_Wud37IPGcGoCnxkmWLee8om_eSIz4OQs-pgDzps6ZM2vNqUNQBi2tDTCmPDLATxS0yY_8IVWmtHEmJ1hmg4DiAeW9G8pj0ZUYIs1ZEGLJBlVGjWQTzMtWyi5hKjFWui1UMuvFA

{
  "header": {
    "alg": "RS256",
    "typ": "JWT",
    "kid": "2026-09-key"
  },
  "payload": {
    "iss": "https://auth.example.com",
    "sub": "usr_42",
    "aud": "orders-api",
    "scope": "orders:read orders:write",
    "iat": 1789475200,
    "exp": 4102444800
  },
  "signature": "UmxJEapoJr6JuE5ieJlzYDoWVCzImtWEI3rtaTN7E4MU_7tsehGbYCg8XZyrZ5E0EDgMe--t9OohnyMnqCAHMWZeSebw897wsF2RN6XWp7FaoxXvjmwSLE0UKJHmxMM9BKUxv6xWdiOWxgLEWva67ItKWEvPWxUZ-BwGKxznjAEjbMd9jYwldCDdPmLalRkveCX9O8POquOK1R2_Wud37IPGcGoCnxkmWLee8om_eSIz4OQs-pgDzps6ZM2vNqUNQBi2tDTCmPDLATxS0yY_8IVWmtHEmJ1hmg4DiAeW9G8pj0ZUYIs1ZEGLJBlVGjWQTzMtWyi5hKjFWui1UMuvFA"
}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "signature": "SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}

eyJhbGciOiJub25lIn0.eyJzdWIiOiJ1c3JfNDIifQ.

{
  "header": {
    "alg": "none"
  },
  "payload": {
    "sub": "usr_42"
  },
  "signature": ""
}

Common errors and how to fix them

Related tools

• Base64 / Base64URL formatter
• JSON formatter
• Unix timestamp to ISO 8601
• HTTP request / response headers formatter
• URL / query string formatter
• online formatters and secret leaks