Is my token sent to your servers?

No. Decoding is 100% client-side using window.atob(). Your token — including any sensitive user IDs or claims — never leaves your browser. Verify this in DevTools → Network tab.

What are the parts of a JWT?

Three Base64URL-encoded strings separated by dots: header.payload.signature. The header specifies the algorithm (e.g., HS256, RS256). The payload contains claims (user data, expiration). The signature is a cryptographic proof that the token wasn't modified.

What algorithm should I use?

RS256 (RSA + SHA-256) or ES256 (elliptic curve) for tokens issued by a trusted server and verified elsewhere — the recipient only needs the public key. HS256 (HMAC + SHA-256) is simpler but requires sharing a symmetric secret between issuer and verifier. Never use "none" — it disables verification entirely.

Why does my JWT have three dots but the third part looks empty?

That's an unsigned JWT (algorithm "none"). It's valid JSON but has no signature, so anyone can create or modify it. Some legacy systems use it internally — never accept it from an untrusted source.

How do I use JWTs securely?

Short expirations (5-60 min) for access tokens; use refresh tokens for renewal. Never store JWTs in localStorage (XSS-vulnerable); use httpOnly cookies. Always validate `exp`, `iss`, and `aud` on the server before trusting the payload.

JWT Decoder

Decode and inspect JSON Web Tokens (JWT). View header, payload, and check expiration status.

JWT Token

Paste your JWT token to decode

About JWT Tokens

JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims between two parties. A JWT consists of three parts:

Header - Contains the algorithm and token type
Payload - Contains the claims (data)
Signature - Verifies the token hasn't been tampered with

The Complete Guide

About the JWT Decoder

JSON Web Tokens (JWTs) are the de facto standard for stateless authentication in modern web apps. Auth0, Okta, Firebase Auth, AWS Cognito, Supabase, and most OAuth 2.0 providers issue JWTs as their access tokens. When your React app makes an authenticated API call, there's almost certainly a JWT in the Authorization header.

But JWTs look like gibberish — three dot-separated Base64URL strings. To debug an authentication issue, verify a claim, or check when a token expires, you need to decode it. Our JWT Decoder splits your token, decodes each part, and shows the header, payload, and signature side-by-side with syntax highlighting.

Everything happens in your browser. Your token is never sent to any server, so you can safely paste production tokens without worrying about them appearing in access logs. We highlight standard claims (iss, sub, aud, exp, iat) and show a human-readable expiration time so you can spot expired tokens instantly.

How to use JWT Decoder

Paste your JWT

Copy the token from your browser DevTools (Application → Cookies or Local Storage), a curl -v output, or an authorization header. Paste it into the input.

See the decoded parts

The decoder splits the token by dots and Base64URL-decodes each part. Header (algorithm and type) and payload (claims) appear as pretty-printed JSON. The signature remains as Base64 — you cannot decode it without the signing key.

Inspect the claims

Standard fields are highlighted: `iss` (issuer), `sub` (subject/user ID), `aud` (audience), `exp` (expiration), `iat` (issued at), `nbf` (not before), `jti` (JWT ID). Custom fields appear below.

Check expiration

The tool converts `exp` and `iat` from Unix timestamps to human-readable dates and warns you if the token is expired or issued in the future (clock skew).

Copy individual parts

Use the copy buttons to grab just the header, payload, or signature — handy when writing test cases or documenting an API.

Common Use Cases

Debug 401 authentication errors

Paste the token your app is sending. Check `iss`, `aud`, and `exp` to see why the server is rejecting it.

Verify token expiration

When a user is suddenly logged out, decode their token to check if `exp` is in the past. Refresh token logic may be broken.

Inspect Firebase, Auth0, Cognito tokens

Every managed auth provider uses JWTs. Decode to see the exact user ID, email, and custom claims they include.

Understand OAuth flows

When debugging OAuth 2.0 with OpenID Connect, the ID token is a JWT. Decode it to see the userinfo claims.

Reverse-engineer partner APIs

When integrating with a third-party API that uses JWTs, decode a sample token to understand the exact claim structure they expect.

Educational use

JWTs are on every intermediate frontend interview. Decoding a real one is the fastest way to teach someone how they work.

Frequently Asked Questions

No. The decoder shows the payload without verifying the HMAC or RSA signature — you would need the signing secret or public key for that. Never trust a decoded JWT payload without verifying the signature on your server first.