About the JWT Decoder
The JWT Decoder splits a JSON Web Token into its header, payload and signature and shows the contents as readable JSON. JWTs are used for login sessions and API authorization by OAuth providers, Firebase, Auth0, Azure AD, ASP.NET Core and many other platforms. When an API returns 401 Unauthorized, decoding the token is usually the fastest way to see whether it has expired or has the wrong audience or roles.
How to Use the JWT Decoder
- Copy the token, usually from the
Authorization: Bearer ...header or local storage. - Paste it into the decoder.
- Read the header (algorithm and token type) and the payload (claims).
- Check the
exp,iat,audandissclaims for problems.
Structure of a JWT
A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature. The header names the signing algorithm, such as HS256 or RS256. The payload contains claims: sub (user id), exp (expiry time), iat (issued at), iss (issuer), aud (audience) and any custom data like roles. The signature proves the token was created by someone holding the secret or private key.
Decoding Is Not Verifying
Anyone can decode a JWT, so the payload is not secret; never put passwords or sensitive personal data in it. Decoding also does not prove the token is genuine. Your server must always verify the signature with the correct key and check expiry, issuer and audience before trusting any claim.
Common Problems
Expired token: compare exp with the current time (both are Unix seconds). Wrong audience or issuer: the API expects a different aud or iss. Clock skew: server clocks that differ by a few minutes can reject fresh tokens. Algorithm mismatch: the API expects RS256 but the token is HS256.
Frequently Asked Questions
Is it safe to paste my token here?
Treat production tokens like passwords. Use test tokens where possible, or tokens that have already expired.
Can this tool verify the signature?
It decodes and displays the token. Signature verification needs your secret or public key and should be done by your server.
Why is exp a big number?
It is a Unix timestamp in seconds. Use the Timestamp Converter to see the exact date.
What is the difference between HS256 and RS256?
HS256 uses one shared secret to sign and verify. RS256 signs with a private key and verifies with a public key, which is better when many services need to verify tokens.