JWTDecoder
Decode JWT tokens securely in the browser to inspect headers, payloads, and claims.
Quick AnswerRead Full Explanation Show Less A JWT Decoder splits the token into three parts and decodes the header and payload to reveal the JSON claims.
Short Answer
A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting data. A JWT decoder parses the token into human-readable JSON so you can read the token's claims (issuer, expiration, user info), but it doesn't verify the signature.
Detailed Explanation
header.payload.signature), Base64URL-decodes the header and payload, and displays the contained JSON data. Signature verification is a separate process. This lets you view claims like iss and exp in plain text.Comprehensive Overview
Encoded Token
Paste your Base64 encoded token string below.
Awaiting JWT Input
Paste a token on the left to analyze its contents.
What Is a JSON Web Token (JWT)?
Definition
A JWT (JSON Web Token) is a self-contained, URL-safe token format defined by RFC 7519 that securely transmits JSON claims between parties. The information is digitally signed, ensuring data integrity.
Why Developers Use It
Because they are self-contained, JWTs hold necessary user information without requiring a backend database query on every request. This stateless nature makes them ideal for scalable APIs and Single Sign-On (SSO).
Key Facts
- Standardized via RFC 7519
- Base64URL encoded, not encrypted
- Stateless and self-contained
- Signed for integrity validation
How To Decode a JWT
- Split the token: JWTs are in the form
header.payload.signature, separated by periods. - Base64-URL decode: Decode the first (header) and second (payload) parts from Base64URL to UTF-8 text.
- Parse JSON: Convert the decoded strings into JSON objects to view the header fields and payload claims.
- (Optional) Verify signature: Use the appropriate secret or public key to check the signature for validity. Without the key, decoding alone only reveals non-sensitive data.
JWT Decode vs JWT Verify
| Action | JWT Decode | JWT Verify |
|---|---|---|
| Purpose | View header and payload contents | Check token signature authenticity |
| Secret/Key Needed | No (just Base64URL decode) | Yes (shared secret or public key required) |
| Output | JSON header and claims | Boolean result (valid/invalid) plus claims |
| Typical Use | Debugging, inspecting token contents on client | Authenticating token before use on backend |
JWT vs Session Cookie
JWT (Token)
Session Cookie
Common Mistakes & Misconceptions
Developer Code Examples
const decoded = jwt.verify(token, 'your-secret-key');
console.log(decoded);
} catch(err) {
console.error("Invalid signature or expired", err);
}
Security Best Practices
Browser & Tech Support
Troubleshooting
JWT Claims Glossary
exp (Expiration Time)
Identifies the exact time on or after which the JWT MUST NOT be accepted.
iss (Issuer)
Identifies the principal that issued the JWT (e.g., auth.example.com).
sub (Subject)
Identifies the principal that is the subject of the JWT (e.g., the User ID).
aud (Audience)
Identifies the recipients that the JWT is intended for.
nbf (Not Before)
Identifies the time before which the JWT MUST NOT be accepted for processing.
iat (Issued At)
Identifies the time at which the JWT was issued.
Frequently Asked Questions
General
What exactly is a JSON Web Token (JWT)?
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.
What does JWT stand for?
JWT stands for JSON Web Token. It is commonly used for stateless authorization and secure information exchange in modern web applications and APIs.
Is JWT an official standard?
Yes, JWT is defined by the Internet Engineering Task Force (IETF) in RFC 7519. It is widely adopted across the industry.
Decoding & Security
How do I decode a JWT token?
To decode a JWT, first split the token string at the periods to isolate the header, payload, and signature. Then, Base64URL-decode the header and payload. You can use our JWT Decoder tool to do this instantly in your browser.
Does decoding a JWT verify its authenticity?
No. Decoding a JWT simply translates the Base64Url string into readable JSON. It does not verify the signature. To verify authenticity and trust the token, you must check its signature against the appropriate secret or public key.
Can I decode a JWT without the secret?
Yes, you can decode the header and payload of a standard JWT without the secret because they are merely Base64URL encoded, not encrypted. However, you cannot verify the signature without the secret.
Is it safe to paste my JWT into an online decoder?
Yes, if the tool processes the token client-side. Our JWT Decoder performs all decoding directly in your browser using JavaScript. The token is never sent to our servers, ensuring your data remains private.
Are JWTs encrypted by default?
No, standard JWTs (JWS) are only signed, not encrypted. Anyone who intercepts the token can decode and read the payload. You should never put sensitive data (like passwords or PII) in a standard JWT.
Developer Q&A
Why does jwt.decode return null or throw an error?
If decoding fails, the token might be malformed (e.g., missing periods, invalid Base64 padding), or it might not be a JWT at all. Ensure the string format is exactly header.payload.signature.
What is the difference between JWT decode and JWT verify?
JWT Decode translates the token's payload to readable JSON so you can inspect it (requires no key). JWT Verify recalculates the signature to mathematically ensure the token was issued by a trusted party and hasn't been tampered with (requires a secret/public key).
What does the 'exp' claim mean?
The 'exp' (expiration) claim identifies the exact time (as a UNIX timestamp) on or after which the JWT MUST NOT be accepted for processing.
Which JWT algorithms are most common?
HS256 (HMAC with SHA-256) is common for symmetric signing (shared secret), and RS256 (RSA Signature with SHA-256) is widely used for asymmetric signing (public/private key pairs).