Decode JWT Online — View Header, Payload & Claims
Decode · Inspect · Verify · Generate JSON Web Tokens — expiry countdown, security warnings, HS256 verify — 100% browser-side
Need to quickly inspect a JWT token during development or debugging? Paste any JWT here and instantly see the decoded header, payload, and all claims in a readable format. The tool highlights standard claims with descriptions, shows Unix timestamps in human-readable date-time format (IST and UTC), and flags expired tokens — making API debugging significantly faster.
What is a JWT Decoder?
A JWT Decoder reads a JSON Web Token and displays its three parts in human-readable format. Every JWT contains a Header (algorithm & type), a Payload (claims — user data, expiry, issuer), and a Signature. This tool decodes all three instantly, shows expiry status with a live countdown timer, highlights standard claims with labels, detects security issues like alg:none, and supports HS256/HS384/HS512 signature verification using the browser Web Crypto API.
JWT Structure — How It Works
A JWT looks like xxxxx.yyyyy.zzzzz — three Base64URL-encoded strings joined by dots. The header and payload are readable by anyone; the signature is what proves authenticity. Only the party holding the secret or public key can verify the signature. This means JWTs should never contain sensitive data like passwords.
Frequently Asked Questions
How do I get a JWT from my app for debugging?
Browser: Open DevTools → Network tab → find an API request → look at Request Headers for "Authorization: Bearer ..." or Response body for a token field. React/Angular DevTools: inspect component state. localStorage/sessionStorage: Application tab in DevTools. Mobile: use a proxy like Charles or Proxyman.
Why does my JWT payload show weird numbers for exp and iat?
exp and iat are Unix timestamps — seconds since January 1, 1970 UTC. This tool automatically converts them to human-readable dates in both UTC and IST. For example: 1700000000 = November 14, 2023, 22:13:20 UTC.
My JWT has a long string in the signature — is it normal?
Yes — the signature length depends on the algorithm. HS256 signatures are ~43 chars. RS256/RS512 signatures are 342-683 chars. ES256 signatures are ~86 chars. Longer signatures indicate RSA (RS256/RS384/RS512) — they're asymmetric and use larger key sizes.
Why is my JWT different every time even with same payload?
For HS256 — if the payload is identical and issued at the same second, the token should be the same. If it's different, the iat (issued at) timestamp is different (issued at different seconds). For RS256/ES256 — these use random padding (PKCS#1 or ECDSA randomness), so the same payload always produces a different signature.
Can I decode a JWT without a library in Node.js?
Yes: const [,payload] = token.split("."); const decoded = JSON.parse(Buffer.from(payload, "base64url").toString()). In modern Node.js (v18+), Buffer supports "base64url" encoding directly. For browser: use atob() with URL-safe character replacement as shown in the FAQ above.