JWT decoder
Inspect any JSON Web Token entirely in your browser. See decoded header, payload, signature, and humanised claims with relative timestamps. The token never leaves your device.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to transmit signed claims between two parties. It's widely used in OAuth/OpenID flows, SPA-to-API authentication, and microservice trust. The token consists of three base64url-encoded parts joined by dots: header, payload, and signature.
What's in a JWT?
Three parts. Header — declares the algorithm (HS256, RS256, etc.) and token type. Payload — the actual claims: subject, expiration, custom data. Signature — the cryptographic proof, computed over the first two parts. The header and payload are just JSON; only the signature requires the signing key to verify.
JWT vs session token
A JWT carries the user identity inside the token, so the server doesn't need a session lookup. A session token is just an opaque ID that maps to server-side state. JWTs scale horizontally without sticky sessions; sessions handle revocation cleanly. Most teams choose JWTs for APIs and sessions for web apps.
Need raw base64 decoding instead? Try our Base64 encoder / decoder.
Common Uses
- OAuth/OIDC debugging: Inspect access and ID tokens returned by Auth0, Okta, Cognito, or any OIDC-compliant provider during integration work.
- API authentication troubleshooting: When a 401 hits in production, decode the token from the Authorization header to check expiry and audience.
- SSO integration: Verify which claims your identity provider is actually emitting before pushing changes to your SAML/OIDC configuration.
- Microservice trust verification: Confirm internal-service tokens carry the correct service identity claim before propagating downstream.
- Postman/Insomnia debugging: Paste a token from your collection variables to confirm it's the right tenant before running tests.
- Mobile app token inspection: Decode tokens captured via mitmproxy or Charles Proxy to verify push-notification subjects and platform claims.
- Code review: Spot-check sample tokens in PRs and unit tests — is exp 5 minutes or 5 days? does sub leak PII? — without leaving the editor.
FAQ
What is a JWT?
A JSON Web Token is a compact, URL-safe means of representing claims (statements about an entity) between two parties. It's defined in RFC 7519 and is the dominant token format for modern API authentication.
Is a JWT encrypted?
No — by default a JWT is signed but not encrypted. The header and payload are just base64url-encoded JSON, readable by anyone holding the token. If you need confidentiality, use JWE (JSON Web Encryption, RFC 7516) — a separate format that wraps an encrypted JWT.
How does base64url differ from base64?
Base64url is the URL-safe variant defined in RFC 4648 §5. It replaces the two unsafe-in-URL characters (+ and /) with - and _, and omits trailing = padding. JWTs use base64url so the token can travel safely in URLs and HTTP headers.
Why doesn't this tool verify the signature?
Verifying a signature requires the signing key — and pasting your production signing key into a browser tool is the worst possible thing you could do with it. We deliberately exclude verification to remove the temptation. Use server-side libraries (jsonwebtoken in Node, jjwt in Java, PyJWT in Python) for actual verification.
JWT vs session — when to use which?
JWTs are great for stateless microservices and mobile clients where you want to avoid session lookups. Sessions are simpler for traditional web apps where you control both the frontend and backend, want easy revocation, and have no horizontal-scale concerns. Many real-world systems use both: a session for the browser, a short-lived JWT for backend RPC.
By the Numbers
- JWTs are defined in RFC 7519 (May 2015) as a compact, URL-safe means of representing claims between two parties
- A JWT is not encrypted by default — anyone holding it can read its payload. Use JWE (RFC 7516) when confidentiality matters
- The signature uses JWS (RFC 7515) — typically HMAC-SHA256 (HS256) for shared-secret tokens or RSA-SHA256 (RS256) for asymmetric verification
- Base64url (used inside JWTs) is the URL-safe variant defined in RFC 4648 §5 — replaces
+//with-/_and omits padding