Need to inspect the contents of a JSON Web Token? Our free online JWT Decoder allows you to instantly parse and view the header, payload, and signature of any JWT to debug authentication issues and verify claims.
Search for a command to run...
Did You Know?
JWTs are not encrypted by default; anyone with access to the token string can decode the payload and read the data.
Best Practice
Never store sensitive information like passwords or PII inside a JWT payload.
A JSON Web Token (JWT) is an open standard (RFC 7519) used to securely transmit information between parties as a JSON object. Because they are digitally signed, the information can be verified and trusted. A JWT typically consists of three parts separated by dots: a Header, a Payload, and a Signature. While the signature ensures the token hasn't been tampered with, the Payload and Header are simply Base64Url encoded, meaning anyone with the token can decode and read their contents.
Tip
Use the 'iat' (issued at) claim to help debug issues where server times are out of sync.
Integrating this tool into your daily routine can significantly speed up identity and access management (IAM) tasks. When working with OAuth2 or OpenID Connect (OIDC), use the decoder to inspect the 'scopes' and 'roles' assigned to a user. During API development, it serves as a quick validator to ensure your middleware is receiving the expected metadata. Always remember that a decoded token is for inspection only; for production logic, your application must always verify the cryptographic signature using a trusted library.
Q: Is my JWT safe when I use this tool? A: Yes, the decoding process is performed locally in your web browser using JavaScript. We do not store or log your tokens.
Q: Why does the decoder show the payload but say the signature is unverified? A: Most online decoders only parse the Base64 data. Verifying a signature requires the public or secret key, which should remain private to your infrastructure.
Q: Can this tool decode an encrypted JWT (JWE)? A: No, this tool is designed for JWS (Signed Tokens). Encrypted tokens (JWE) require a decryption key to view the content.
Q: What is the 'exp' claim? A: The 'exp' claim is a Unix timestamp indicating when the token expires. After this time, the token should no longer be accepted.
Best Practice
Always use HTTPS when transmitting JWTs to prevent them from being intercepted by man-in-the-middle attacks.