JWT Decoder
Paste a JSON Web Token to read its header, payload and claims. Decoding happens in your browser — the token never leaves this page.
Your token is decoded locally with JavaScript. Nothing is sent to ToolGenie or any other server, and nothing is stored.
How to Use the JWT Decoder
- Copy the JSON Web Token from your API response, Authorization header, cookie, or log line.
- Paste it into the token box above — spaces and line breaks are ignored.
- Click "Decode" to split the token into its header, payload and signature parts.
- Read the pretty-printed JSON, then check the claims summary for the issuer, audience and expiry date.
- Use "Copy header" or "Copy payload" to paste the JSON into a ticket or test, and "Clear" to wipe the field.
What Is a JWT Decoder?
A JSON Web Token is three Base64URL-encoded parts joined by dots: a header describing the signing algorithm, a payload holding the claims, and a signature. A JWT decoder reverses that encoding so you can read the header and payload as plain JSON instead of squinting at an opaque string in a log file.
Because the header and payload are only encoded — not encrypted — anyone holding the token can read them. That is exactly why this JWT debugger is useful when an API returns 401, when a session expires sooner than expected, or when you need to confirm which issuer, audience and subject a token really carries. The claims summary converts the numeric exp, nbf and iat timestamps into readable dates and flags whether the token has already expired.
Working with tokens usually means reaching for a few neighbours: the Base64 encoder and decoder for the raw segments, the hash generator for checksums and HMAC inputs, and the AES encrypt and decrypt tool when a value genuinely needs to stay secret rather than merely encoded.
Frequently Asked Questions (FAQ)
How do I decode a JWT token online?
Paste the full token into the box above and click "Decode". The tool splits it on the dots, Base64URL-decodes the first two segments and shows the header and payload as formatted JSON.
Does this JWT decoder verify the signature?
No. It decodes only. Signature verification needs the shared secret or the issuer's public key, and doing that in a browser tool would mean handing over your signing key. Always verify server-side before trusting a claim.
Is it safe to paste a JWT into an online decoder?
With this one, the decoding runs entirely in your browser and the token is never uploaded. Even so, a live access token is a credential — prefer expired or test tokens, and rotate anything you paste into a tool you do not control.
How do I read the exp claim of a JWT?
The exp claim is a Unix timestamp in seconds, not milliseconds. The claims summary above shows the raw number alongside the local date and marks the token as expired or not expired at the moment you decoded it.
Why does my JWT fail to decode?
The usual causes are a missing third segment, a copied fragment that lost characters at the end, or a stray Bearer prefix. A valid JWT has exactly three Base64URL parts separated by two dots.
Is a JWT encrypted or just encoded?
A standard signed JWT (JWS) is only Base64URL-encoded, so the payload is readable by anyone. Signing proves the token was not altered; it does not hide the contents. Never put passwords or personal secrets in a JWT payload.
What is the difference between a JWT parser and a JWT debugger?
They describe the same job from different angles: a parser turns the token into structured data, while a debugger also helps you spot why a token is rejected — a wrong audience, a clock-skewed nbf, or an exp that already passed.
Tips for Working with JSON Web Tokens
- Tip 1: When a token is rejected, compare exp and nbf against your server clock first — a few minutes of clock skew explains most mysterious 401 responses.
- Tip 2: Keep payloads small. Every request carries the token, so extra claims cost bandwidth on every single call.
- Tip 3: Check the header's "alg" value. A token arriving with "none", or with an algorithm your API did not expect, is a red flag worth investigating.
- Tip 4: Signing secrets deserve the same care as passwords — create one with the password generator and sanity-check its entropy with the password strength checker before it protects production tokens.