JWT Decoder - Decode & Inspect JSON Web Tokens Online
JSON Web Tokens (JWT, RFC 7519) are the industry standard for stateless web authentication and API authorization. A JWT consists of three Base64URL-encoded parts separated by dots: Header, Payload, and Signature. Developers frequently need to verify token expiration dates (exp), inspect user permission claims (roles), or diagnose "401 Unauthorized" errors without risking token leakage to remote logging services.
When to Use This Tool
- Token Expiration Inspection: Convert Unix epoch timestamps in the "exp" claim to readable local dates to debug premature logouts.
- RBAC Permission Auditing: Verify whether the expected roles, scopes, or group attributes are properly contained in the payload.
- 401 Unauthorized Troubleshooting: Inspect issuer (iss) and audience (aud) claims to diagnose token validation failures.
- Algorithm & Header Verification: Check the signing algorithm (e.g., HS256, RS256) and Key ID (kid) defined in the token header.
How to Use
- Paste Token: Paste your raw Bearer or Authorization JWT string into the input editor.
- Instant Decoding: The tool automatically splits the 3 dot-delimited segments and decodes the Base64URL data.
- Inspect Claims: Review the formatted Header and Payload JSON blocks with highlighted expiration status.
- Copy JSON: Copy the parsed payload claims to your clipboard for documentation or code testing.
Input & Output Example
Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.4z...
Output:
{
"sub": "1234567890",
"name": "John Doe",
"role": "admin",
"iat": 1516239022,
"exp": 1916239022 (Valid)
}
Frequently Asked Questions (FAQ)
Q. Does decoding a JWT compromise security?
A. JWT payloads are simply Base64URL-encoded, meaning anyone who has the token can read the claims. Decoding reveals the content, but the signature part requires the private/secret key to forge. Never store sensitive passwords or credit card numbers in a JWT payload.
Q. Can this tool verify the signature of my token?
A. This tool decodes the token claims purely on the client side. To verify the cryptographic signature, you must provide your private key or public certificate, which should always remain securely protected in your local/backend environment.
Q. Why does my token say "Expired"?
A. The "exp" (Expiration Time) claim is an epoch timestamp in seconds. If the current system time is greater than this value, the token has expired and API gateways will reject it with a 401 response.
Engineering & Privacy Notes
- Tokens are processed strictly inside your browser memory; zero network transmission ensures your session credentials remain private.
- Supports standard RFC 7519 JWT specifications including common claims: sub, iss, aud, exp, nbf, and iat.
Related Developer Tools