JWT Decoder

How the JWT Decoder works

A JSON Web Token consists of three dot-separated parts: header, payload, and signature. The header and payload are base64url-encoded JSON objects.

This tool decodes those two parts into readable JSON so you can inspect claims and debug authentication flows quickly.

If the token uses the HS256 algorithm, the tool can recompute the HMAC SHA-256 signature locally and compare it to the token’s signature.

1. Header: Contains metadata such as alg (algorithm) and typ (token type).
2. Payload: Contains claims like sub, exp, roles, scopes, and custom fields.
3. Signature: Detects tampering; HS256 can be verified with a shared secret.
4. Local execution: All decoding and verification happen in your browser.

When to use a JWT decoder

JWT decoders are essential when APIs reject requests, tokens expire unexpectedly, or claims don’t match what your backend expects.

They also help verify that authentication providers are issuing correct claims before rolling out changes to production.

1. API debugging: Inspect Bearer tokens sent in Authorization headers.
2. Auth troubleshooting: Confirm exp, iat, aud, and issuer values.
3. Role checks: Verify scopes, permissions, and custom claims.

Security notes and best practices

Decoding a JWT does not make it trustworthy. Anyone can base64-decode a token, so signature verification and proper backend validation are critical.

Never rely on decoded JWT data alone for authorization decisions without server-side verification.

1. Decoding: Shows contents but does not guarantee authenticity.
2. Verification: HS256 verification checks integrity but not expiration or audience.
3. Production use: Always validate tokens server-side.