JWT Token Decoder
Decode JWT tokens and inspect Header, Payload, and Signature
Frequently Asked Questions
What is a JWT and what does the decoder do?
A JSON Web Token is a compact token made of three Base64URL-encoded segments (Header, Payload, Signature) joined by dots. It is widely used for authentication, API authorization, and single sign-on. The decoder splits those segments back into readable JSON so you can inspect the algorithm, expiration (`exp`), subject (`sub`), and other claims.
What can this tool help me do?
Common use cases include diagnosing "token expired" errors, confirming that backend-issued claims are correct, debugging third-party OAuth/OIDC integrations, reviewing `kid`/`alg` header values, and sharing token contents with teammates without exposing signing secrets.
Is decoding a JWT the same as verifying it?
No. Decoding just splits the Base64URL segments — anyone can do it. Verification requires the signing key (an HMAC secret or RSA/ECDSA public key) to recompute the signature and compare. This tool focuses on decoding and claims inspection; your backend must still perform cryptographic verification in production.
Why does my token show as invalid?
A JWT must have exactly three segments, each valid Base64URL (uses `-`, `_`, no `=` padding). Common mistakes: truncating on copy, including the `Bearer ` prefix, or pasting a URL-encoded cookie value. Make sure there are three parts and each uses the correct alphabet.
Are my tokens uploaded or logged?
No. Decoding happens entirely in your browser. Tokens are never sent to a server or written to logs, so it is safe to inspect production tokens while debugging.
How does JWT compare to sessions or API keys?
Sessions keep user state on the server and work well for monoliths. API keys are usually long-lived and best for machine-to-machine calls. JWTs carry claims in-band and enable stateless verification, which suits distributed systems. The trade-off is that JWTs cannot be revoked instantly, so sensitive flows usually pair short-lived access tokens with refresh tokens.