Decode and inspect JSON Web Tokens instantly. Runs entirely in your browser — nothing sent to any server.
JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and authorization. A JWT consists of three parts separated by dots: Header (algorithm and token type), Payload (claims/data), and Signature (cryptographic verification).
Common use cases: API authentication (OAuth2/OpenID Connect tokens), session management (stateless sessions), information exchange (securely transmitting claims between parties). ⚠️ Never store secrets or sensitive data in a JWT payload — the payload is only base64-encoded, not encrypted. Anyone who intercepts the token can read it.
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and information exchange. It consists of a header, payload, and signature separated by dots.
The decoder displays the token contents and structure. For signature verification, use a dedicated library with your secret key or public key.
The decoding runs entirely in your browser. Tokens are not sent to any server or stored anywhere.
JSON Web Tokens carry claims (subject, expiry, roles) in a compact Base64URL payload. This tool decodes the header and payload in your browser so you can inspect claims during debugging — without sending the token to our servers. It does not verify signatures; treat decoded contents as untrusted until your app validates them.
exp / nbf timestamps during clock-skew issuesaud) and issuer (iss) against your API configThe header usually names the algorithm (alg) and token type. The payload holds claims. Expired exp values explain many sudden logouts. Algorithms like none or unexpected alg changes are red flags in production. Never paste production refresh tokens into untrusted online tools — this page keeps decoding local for that reason.
An API rejected tokens right after deploy. Decoding showed aud still pointed at the staging API identifier while the new gateway expected production. Updating the auth client’s audience fixed authorization without rotating every user password.
No signature verification, key lookup, or JWE decryption. Encrypted tokens will not yield a readable payload here. Pair with your identity provider’s docs for validation rules.
JWT Tokens Explained · JSON Formatter · Base64 Encoder · All tools