JWT Decoder: Read a JSON Web Token Online

Example

Input:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3MDAwMDAwMDB9.signature

Result:

header: { "alg": "HS256", "typ": "JWT" }   payload: { "sub": "123", "role": "admin", "iat": 1700000000 }

What is inside a JWT

A JSON Web Token is three base64url-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm (for example HS256 or RS256) and the token type. The payload carries the claims, such as sub (subject), iat (issued at), exp (expiry) and any custom fields like a role. The signature lets the server check that the first two parts were not changed.

Base64url is an encoding, not encryption. Anyone holding the token can read the header and payload, which is exactly what this tool does. Never put passwords or other secrets in a JWT payload.

Decoding is not verifying

This page decodes the token so you can debug it. It does not check the signature, because that needs the secret or public key, and you should never paste a production secret into any website. A decoded token that looks fine may still be forged or expired. Your API must verify the signature, the algorithm, exp, and the issuer and audience on every request.

Do not paste live production tokens into online tools, including this one. The decoding happens in your browser and nothing is sent, but a token is a bearer credential, so use short-lived test tokens when you can.

Common claims to check when debugging

When a request fails with 401, look at exp first: it is a Unix time in seconds, and this tool shows it as a date and tells you whether it has passed. Then check iat and nbf for clock skew between servers, aud and iss for the wrong environment, and the alg header for a mismatch with what your server accepts. Short access tokens paired with a refresh token, plus role checks on the server, are the usual pattern in Express and Angular apps.

In Express, verify with jsonwebtoken and pin the algorithm: jwt.verify(token, secret, { algorithms: ["HS256"] }). Leaving the algorithm open has caused real vulnerabilities, such as tokens signed with "none" being accepted.

Related tools

• ObjectId to Date
• JSON to TypeScript
• HTTP Status Codes