JWT Decoder

JWT (JSON Web Token) decoding is something I do almost daily when debugging authentication issues, inspecting API tokens, or troubleshooting SSO integrations. When a user reports 'access denied' errors, the first thing I do is decode their JWT to check expiration time, roles, and claims. This tool decodes JWTs instantly without sending tokens to any server—critical when handling production access tokens or customer credentials. It splits the token into three parts (header, payload, signature), Base64-decodes the first two, and displays the JSON content in readable format. The signature is shown but not verified—this is an inspection tool, not a validator. Perfect for developers integrating OAuth2, debugging Auth0/Cognito tokens, or understanding how JWT-based authentication works.

How to Use

Paste a JWT token (format: xxxxx.yyyyy.zzzzz) into the input field. The tool automatically splits it into header, payload, and signature sections. Header shows algorithm (HS256, RS256, etc.) and token type. Payload displays claims like user ID (sub), expiration (exp), issued at (iat), issuer (iss), and custom claims your app adds. Expiration times are Unix timestamps—the tool can convert these to readable dates. Use this when APIs return 401 errors to check if tokens expired, when debugging authorization to verify role/permission claims are present, or when learning JWT structure. IMPORTANT: This tool does NOT verify signatures—it only decodes. Never trust a JWT without proper signature verification in your backend.

Common Use Cases & Examples

**Debug Auth Errors**: User gets 401 error; decode their token to check if exp (expiration) timestamp has passed—tokens typically expire in 15-60 minutes. **Verify Claims**: Decode access token to confirm required claims (roles, permissions, email verified) are present before investigating other issues. **Multi-tenant Debugging**: Check tenant_id or organization_id claims in token to ensure user is accessing correct tenant resources. **Token Comparison**: Decode tokens from different environments (dev/staging/production) to compare claim differences. **Learning OAuth2/OpenID**: Paste sample tokens from Auth0, Cognito, or Keycloak to understand structure and standard claims like aud (audience) and scope.

Limitations & Important Notes

This tool ONLY decodes JWTs—it does NOT verify signatures or validate tokens. A decoded token showing valid claims doesn't mean the token is authentic; attackers can craft tokens with false claims. Always verify signatures server-side using your secret key or public key (for RS256). The tool works with standard JWT formats (header.payload.signature in Base64URL encoding). It doesn't handle encrypted JWTs (JWE) or nested tokens. If your token includes binary data or non-standard encoding, decoding may fail. For automated token validation in code, use proper JWT libraries like jsonwebtoken (Node.js), PyJWT (Python), or jose4j (Java). Security note: Don't paste sensitive production tokens into online tools you don't trust—this tool runs client-side, but always verify in DevTools Network tab that nothing is uploaded.