Understanding JSON Web Tokens with the JWT Decoder
What this decoder does
A JSON Web Token is three Base64URL-encoded parts joined by dots: a header, a payload, and a signature. This decoder splits the string on those dots, turns the header and payload back into readable JSON, and displays the raw signature segment. It reads the alg field from the header, then surfaces the standard registered claims — sub, iss, aud, jti — alongside the timing claims so you can see at a glance what the token asserts.
Decoding runs the moment you paste a token, so there is no separate submit step. A sample token is available too if you just want to see how a decoded structure looks.
When to reach for it
Reach for it whenever an authenticated request behaves unexpectedly and you need to see what the token actually carries. A common case is a 401 you cannot explain: paste the token and the status line tells you at once whether it has expired, has not become valid yet, or is still inside its active window.
It is also handy while wiring up a login flow — confirming that the issuer, audience, and subject match what the backend expects, or checking that a custom claim you added on the server really made it into the payload.
Example: reading the three parts
Take a token shaped like eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.SflKx... — the first segment decodes to a header such as {"alg":"HS256","typ":"JWT"}, the second to a payload like {"sub":"1234","iat":1700000000,"exp":1700003600}, and the third stays as the opaque signature. The decoder converts the numeric iat and exp values into local dates and, while the token is still live, shows how long remains before it expires.
Notes and edge cases
Decoding is not verification. This tool never checks the signature against a secret or public key, so a decoded token proves only what it claims, not that those claims are trustworthy — always verify the signature server-side with a proper library before acting on a token. Because the payload is merely Base64URL-encoded, treat everything in it as readable to anyone who holds the token; it is not encrypted. For the same reason, avoid pasting live production tokens you do not own, and remember that exp and nbf are Unix timestamps in seconds, which is why a token reads as expired the instant its exp passes.