JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, expiration, and claims.
What is a JWT Decoder?
A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting claims between parties. A JWT consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims like user ID, roles, and expiration), and the signature (cryptographic verification). JWTs are the standard token format for OAuth 2.0, OpenID Connect (OIDC), and API authentication across modern web applications.
This JWT decoder helps developers, DevOps engineers, and security engineers inspect token contents during authentication debugging, API troubleshooting, and security audits. Common use cases include verifying token claims before and after authentication flows, checking expiration timestamps (exp claim), inspecting OIDC identity tokens from providers like Auth0 or Cognito, debugging RBAC policies based on role claims, and investigating authentication failures in microservice architectures. Decoding happens entirely in your browser—no tokens are sent to external servers.
Frequently Asked Questions
Can you decode a JWT without the secret?
Yes, the header and payload of a JWT can be decoded by anyone—they are simply Base64URL-encoded, not encrypted. The secret (or private key) is only needed to verify the signature, which proves the token was not tampered with. This is by design: JWTs are meant to carry readable claims. Never put sensitive data in JWT payloads unless you use JWE (encrypted tokens).
How to check if a JWT is expired?
Look at the exp (expiration) claim in the decoded payload. It contains a Unix timestamp indicating when the token expires. Compare it to the current time: if the current Unix timestamp is greater than exp, the token is expired. Most JWT libraries automatically check expiration during verification. The iat (issued at) and nbf (not before) claims provide additional timing context.
What is the difference between JWS and JWE?
JWS (JSON Web Signature) is the most common JWT format—it signs the payload to ensure integrity but the payload remains readable by anyone. JWE (JSON Web Encryption) encrypts the payload so only authorized parties with the decryption key can read the claims. Most "JWT tokens" in practice are JWS tokens. Use JWE when the token payload itself contains sensitive information that should not be visible to the client.