JWT Token Decoder — Decode Bearer Tokens Online
Decode · Inspect · Verify · Generate JSON Web Tokens — expiry countdown, security warnings, HS256 verify — 100% browser-side
Bearer tokens are the most common form of JWT in production APIs — sent as Authorization: Bearer eyJ... in HTTP headers. This decoder automatically strips the "Bearer " prefix so you can paste the full header value directly. It shows the decoded header algorithm, all payload claims, expiry status, and security warnings in a clean three-section layout.
What is a JWT Decoder?
A JWT Decoder reads a JSON Web Token and displays its three parts in human-readable format. Every JWT contains a Header (algorithm & type), a Payload (claims — user data, expiry, issuer), and a Signature. This tool decodes all three instantly, shows expiry status with a live countdown timer, highlights standard claims with labels, detects security issues like alg:none, and supports HS256/HS384/HS512 signature verification using the browser Web Crypto API.
JWT Structure — How It Works
A JWT looks like xxxxx.yyyyy.zzzzz — three Base64URL-encoded strings joined by dots. The header and payload are readable by anyone; the signature is what proves authenticity. Only the party holding the secret or public key can verify the signature. This means JWTs should never contain sensitive data like passwords.
Frequently Asked Questions
What is a Bearer token?
A Bearer token is an access token sent in the HTTP Authorization header: "Authorization: Bearer <token>". The word "Bearer" means "whoever holds this token gets access". JWTs are commonly used as bearer tokens in OAuth 2.0 and REST APIs.
Why does my JWT have three dots?
JWT has exactly three Base64URL-encoded parts separated by dots: header.payload.signature. The header contains algorithm info, the payload contains claims, and the signature verifies authenticity. If you see more or fewer dots, it's not a valid JWT.
Can I use this tool with Firebase Auth tokens?
Yes — Firebase ID tokens are standard JWTs signed with RS256. Paste your Firebase ID token and you'll see the sub (user UID), email, email_verified, iss (accounts.google.com/...), aud (your Firebase project ID), and expiry. The kid in the header identifies the Firebase signing key.
What is the kid claim in the JWT header?
kid = Key ID. It tells the server which key was used to sign the token — useful when the server rotates keys (has multiple active keys at once). The server fetches the matching public key using kid from its JWKS (JSON Web Key Set) endpoint and uses it to verify the signature.
How do I get the raw JWT from my browser's localStorage?
Open DevTools → Application tab → Local Storage → find your token key (often "token", "access_token", "jwt", or "authToken"). Copy the value and paste here. Alternatively: in the Console tab, type localStorage.getItem("token") to get it.