JWT Decoder - Decode & Inspect JSON Web Tokens Online

Decode, inspect, and analyze JSON Web Tokens instantly with our free online JWT decoder. When developing web applications, troubleshooting OAuth 2.0 or OpenID Connect (OIDC) authentication flows, or debugging microservices, JWTs encapsulate user identities and access privileges inside compact, URL-safe Base64URL strings. This tool unpackages the token's Header, Payload, and Signature into clean, readable JSON.

Built specifically for backend engineers, frontend developers, and security auditors, our JWT inspector automatically calculates token expiration dates, validates standard claims (such as iss, sub, aud, and exp), and provides real-time validity status. For other web formatting and encoding tasks, explore our related utilities like the URL Encoder and URL Decoder.

100% Private & Client-Side: Your security credentials matter. Decoding happens entirely inside your browser runtime using native JavaScript Web APIs. Session tokens, sensitive user claims, bearer tokens, and signatures are never transmitted across the network, stored in remote databases, or logged on servers.

JWT Decoding Example: Before & After

A JSON Web Token consists of three distinct Base64URL-encoded parts separated by dots (.): Header, Payload, and Signature. Decoding unwraps the first two segments into structured JSON documents.

Input (compact encoded JWT string):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.4flK8R_yqD7r6H9cW7H3sZ3fX7Q6xM_mN2vP4kL9wR0

Output - Decoded Header JSON:

{
  "alg": "HS256",
  "typ": "JWT"
}

Output - Decoded Payload Claims JSON:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1916239022
}

The token header confirms HMAC SHA-256 signing, while the payload reveals the user subject ID, display name, issue timestamp, and future expiration date.

How to Use the JWT Decoder

1. Open the Inspector: Click the Try It button below to launch the two-pane token workspace.
2. Paste Your Token: Paste your JWT into the left input area, or click Load Sample Token to test with a pre-configured sample.
3. Instant Real-Time Parsing: As soon as a token is entered, the tool decodes both the Header and Payload segments into formatted JSON.
4. Inspect Claims & Expiration: Review the token status badge to verify whether the token is currently active or expired, along with human-readable timestamps.
5. Copy or Download: Use the one-click copy button to grab the complete decoded JSON payload or download it as a .json file.

Key Features

• RFC 7519 Specification Compliant: Faithfully handles standard Base64URL decoding, unpadding, and JSON parsing.
• Automated Expiration Check: Automatically converts the UNIX epoch exp timestamp into local date/time and flags active vs. expired tokens.
• Standard Claims Analysis: Extracts and highlights standard registered claims (iss, sub, aud, iat, nbf, exp) in a clean overview table.
• Full Unicode & UTF-8 Decoding: Correctly displays multi-byte international characters and accented user profile data in token payloads.
• Sample JWT Loader: One-click sample loading allows developers to test the decoder immediately without copying credentials.
• 100% Client-Side Privacy: Tokens remain strictly inside your browser memory—no third-party logging or transmission.

Common Use Cases

• OAuth 2.0 & OIDC Debugging: Inspecting access tokens and ID tokens issued by Auth0, Okta, Firebase, AWS Cognito, Keycloak, or Microsoft Entra ID.
• Token Expiration Verification: Verifying whether an authorization failure in API testing (HTTP 401 Unauthorized) is caused by an expired exp claim.
• Role & Scope Auditing: Checking custom user claims, RBAC permissions, tenant IDs, and scopes contained in microservice tokens.
• Algorithm Inspection: Confirming whether the signing algorithm matches expectations (e.g., RS256 vs HS256) and flagging insecure none configurations.
• Mobile & Single-Page App Testing: Verifying authentication token storage and claims transmission in React, Angular, Vue, and mobile applications.

About JSON Web Tokens & RFC 7519 Architecture

A JSON Web Token (JWT) is a standardized, self-contained mechanism for securely transmitting information between parties as a JSON object, formalized in RFC 7519. Because tokens are digitally signed, the recipient can verify that the claims have not been tampered with after generation.

The Anatomy of a JWT: A token consists of three parts separated by period (.) delimiters:

• Header: Typically consists of two properties: the token type (usually JWT) and the signing algorithm being used (such as HS256 for HMAC with SHA-256, or RS256 for RSA signatures).
• Payload: Contains the claims—statements about an entity (typically the user) and additional metadata. RFC 7519 defines registered claims: iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (unique identifier). Applications can also define custom claims like roles and permissions.
• Signature: Generated by taking the encoded header, the encoded payload, a secret or private key, and passing them to the specified cryptographic algorithm. The signature guarantees data integrity.

Base64URL vs. Standard Base64: To make tokens completely safe for inclusion in HTTP authorization headers, cookies, and URL query strings without requiring URL-encoding, JWT specifications mandate Base64URL encoding. Base64URL replaces + with -, / with _, and removes trailing = padding characters.

Decoding vs. Verification: It is crucial to understand that decoding a JWT is not the same as verifying it. Anyone can decode a JWT because Base64URL is merely an encoding format, not encryption. Verification requires calculating the signature using the issuer's public key or shared secret. Never trust claims from an unverified token in security-critical backend systems.

Common Errors & Security Considerations

• Storing Sensitive Secrets in Payloads: Because JWT payloads are readable by anyone who inspects network traffic or client storage, never store database passwords, encryption keys, or unhashed credentials inside standard JWTs. Use JSON Web Encryption (JWE) if payload confidentiality is required.
• Expired Token (exp): The most common API error. If the current UNIX timestamp exceeds the value in exp, the token is expired and must be refreshed via a refresh token flow.
• Clock Skew Issues: If client and server clocks disagree by even a few seconds, tokens with strict nbf (not before) or exp claims may be rejected prematurely. Production backends often configure a 30-to-60 second clock skew tolerance.
• The "alg: none" Vulnerability: Historically, some flawed token libraries accepted tokens with "alg": "none" and bypassed signature checks. Ensure your backend strictly enforces expected signing algorithms.

Related Developer Utilities

Explore complementary developer tools on BitCompiler to streamline your workflow:

• URL Encoder: Percent-encode URLs, query parameters, and special characters.
• URL Decoder: Decode percent-encoded URLs and form query strings into plain text.
• URL Slug Generator: Generate clean, SEO-friendly URL slugs from arbitrary strings.
• AES Encrypt: Encrypt sensitive text and secrets client-side using AES encryption.
• AES Decrypt: Decrypt AES ciphertext back to original text with your secret key.