### JWT Token Input Sample Live Preview

_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..._

Decode  Clear

### Decoded Output Live

Start typing JWT to see live preview...

# JWT Decoder - Free Online JSON Web Token Inspector

Decode a three-part JWT to inspect its header and payload, including claims such as expiry. Decoding does not verify the signature or validate the claims.

## What Is a JWT? Complete Guide to JSON Web Tokens

A **JSON Web Token (JWT)** is an open standard ([RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519)) that defines a compact, self-contained method for securely transmitting information between parties as a JSON object. JWTs are widely used in modern web applications for **authentication**, **authorization**, and **information exchange** between microservices and APIs.

A common signed JWT has three parts separated by dots (`.`): **Header.Payload.Signature**. The header describes the token, and the payload carries claims. The signature can help detect modification only when a receiving application verifies it with a trusted key. The header and payload are encoded, not encrypted, so anyone holding the token can read them.

JWTs are used as OAuth 2.0 access tokens, OpenID Connect ID tokens, API authentication credentials, and stateless session tokens in single-page applications (SPAs), mobile apps, and microservice architectures.

### JWT Structure: Header, Payload, and Signature Explained

#### Part 1: Header

The header typically contains two fields:

```
{
"alg": "HS256",
"typ": "JWT"
}
```

The `alg` field specifies the signing algorithm. Common values: `HS256` (HMAC-SHA256), `RS256` (RSA-SHA256), `ES256` (ECDSA-SHA256), `none` (unsigned - dangerous). The `kid` (key ID) field is sometimes present for key rotation.

#### Part 2: Payload (Claims)

The payload carries claims:

```
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622
}
```

Standard claims: `sub` (subject), `iss` (issuer), `aud` (audience), `exp` (expiration), `iat` (issued at), `nbf` (not before), `jti` (JWT ID). Custom claims can store any application-specific data.

#### Part 3: Signature

The signature is computed as:

```
HMACSHA256(
base64url(header) + "." +
base64url(payload),
secret
)
```

A properly verified signature can reveal that a token has been modified. This tool displays the decoded content but does not perform that verification or establish that its claims are trustworthy.

### Example JWT Token Decoded

#### Raw JWT Token

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE1MTYyNDI2MjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

#### Decoded Header

```
{
"alg": "HS256",
"typ": "JWT"
}
```

#### Decoded Payload

```
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622
}
```

### JWT Use Cases: When and Why JWTs Are Used

#### OAuth 2.0 Access Tokens

OAuth 2.0 authorization servers issue JWT access tokens that clients include in API requests (`Authorization: Bearer <token>`). Resource servers validate the token's signature and claims without querying the authorization server, enabling stateless authentication at scale.

#### OpenID Connect (OIDC) ID Tokens

OIDC extends OAuth 2.0 with ID tokens - JWTs that carry identity claims about the authenticated user (name, email, profile picture, email verification status). Used by identity providers like Google, Microsoft, Auth0, Okta, and Keycloak.

#### Single Sign-On (SSO)

Enterprise SSO systems use JWTs to carry authenticated identity across multiple applications within an organization. The user authenticates once, receives a JWT, and that token grants access across all integrated apps without re-authentication. Common in SAML alternatives and modern identity platforms.

#### Microservice Authentication

In microservice architectures, service-to-service API calls are authenticated using JWTs. An API gateway validates incoming JWTs and may issue internal service tokens. JWTs carry user context (user ID, roles, permissions) without requiring each microservice to query a central user database.

#### API Key Authentication

Some APIs issue signed JWTs as long-lived API credentials. These can carry rate limit tiers, allowed scopes, and expiry information within the token itself, enabling the API to make authorization decisions without database lookups.

#### Session Tokens for SPAs and Mobile Apps

Single-page applications (React, Vue, Angular) and mobile apps commonly store JWTs in memory or localStorage to maintain authenticated sessions. The token is sent with each API request, allowing stateless backend APIs that do not maintain server-side session state.

### JWT Security Best Practices

- **Never put sensitive data in JWT payloads.** JWT payloads are only Base64URL-encoded, not encrypted. Anyone with the token can read the payload. For confidential data, use JWE (JSON Web Encryption) which encrypts the payload.
- **Verify the signature before trusting claims.** Decoding alone is for inspection. An application must verify the signature and validate the expected issuer, audience and time claims.
- **Use short expiration times (`exp`).** Access tokens should typically expire in 15–60 minutes. Use refresh tokens for longer sessions. Short-lived tokens limit the damage if a token is stolen.
- **Validate all claims.** Always check `iss` (issuer), `aud` (audience), `exp` (expiration), and `nbf` (not before) in addition to the signature.
- **Use strong algorithms.** Prefer RS256 or ES256 (asymmetric) for production systems. HS256 requires securely sharing the secret key between token issuer and verifier. Never accept `alg: none` tokens.
- **Transmit only over HTTPS.** JWTs in transit must be protected by TLS. Never send JWTs over unencrypted HTTP.
- **Do not paste production tokens into online tools.** Use this tool only for development, testing, and debugging with non-production tokens.

### Frequently Asked Questions About JWT Decoding

#### Can I decode a JWT without a secret key?

You can read the header and payload of a typical three-part signed JWT without its signing key. The contents are encoded, not encrypted. This decoder does not decrypt encrypted JWTs.

#### Does decoding a JWT verify its signature?

No. Decoding only displays the token's contents. The application accepting a token must verify its signature with a trusted key and validate the expected claims before trusting it.

#### Can I use production tokens?

Use a disposable test token instead. Input is processed and saved in local browser storage. Saved input is restored for up to 30 days and older input is removed on a later visit; choose Clear when finished. Treat a live token as a credential.

#### What does the exp claim mean?

The exp claim expresses an expiration time as Unix seconds. Compare it with the current time, but do not treat a decoded value as trustworthy until the token has been verified.

#### Can this tool open an encrypted JWT?

No. It reads the JSON header and payload of three-part tokens. An encrypted JWT commonly uses five parts and requires an appropriate decryption key.

#### Why does a decoded token still fail authentication?

The signature may be invalid, the token may be expired or not yet valid, or its issuer, audience or permissions may not match what the receiving service expects. This decoder does not check these conditions.

### Continue debugging your token

Need a disposable example? Create one with the [JWT generator](https://www.toolcomb.com/jwt-generator), then return here to inspect its claims. To make a decoded payload easier to read or compare, open the [JSON formatter](https://www.toolcomb.com/json-formatter).

For an expiry claim, compare its Unix timestamp with the current time using the [Unix timestamp converter](https://www.toolcomb.com/unix-timestamp-converter). A readable expiry alone does not establish that the token is authentic or accepted by your application.

## Related Tools

Discover more free tools that might help with your next task.

[Base64 Encoder Encode and decode Base64 data Use Tool](https://www.toolcomb.com/base64-encoder)

[URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder)

[HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder)

[Hash Generator Generate MD5, SHA1, SHA256 hashes Use Tool](https://www.toolcomb.com/hash-generator)

[UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator)

[Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator)

### Related guides

Read the how-to, then come back to this tool when you are ready to run it locally.

- [JWT Generate vs Decode - What Belongs in the Browser Decode claims locally, generate test tokens with dummy keys - never mint production JWTs or paste live secrets into any website tab.](https://www.toolcomb.com/blog/jwt-generate-vs-decode-safely)
- [Base64 Is Not Encryption: Encoding vs Secrets Base64 hides nothing. Why people treat it like a cipher, what it is actually for (data URLs, JWTs, APIs), and how to encode or decode in the browser without uploading a key.](https://www.toolcomb.com/blog/base64-is-not-encryption)
- [What Not to Paste Into Online Developer Tools JWTs, API keys, customer JSON, and password checkers: a practical list of what to keep off random websites, and which jobs can stay in the browser.](https://www.toolcomb.com/blog/what-not-to-paste-into-online-developer-tools)

[View All Tools](https://www.toolcomb.com/tools)