JWT Decoder: Inspect Tokens Without Verification

JWTs are everywhere in modern apps. When authentication breaks, the fastest way to troubleshoot is to decode the token and inspect its header and payload. A JWT decoder lets you do that instantly without verifying signatures or sending data to a server.

This guide explains what a JWT contains and how to use a decoder safely.

What a JWT includes

A JWT has three parts:

• Header: token type and signing algorithm
• Payload: claims like user ID, roles, and expiration
• Signature: used to verify integrity

Decoding lets you view the header and payload in plain JSON.

When to decode tokens

• Debugging login issues
• Checking expiration (exp) values
• Confirming roles and permissions
• Inspecting issuer or audience claims

Fast workflow

1. Paste the token into the decoder.
2. Review header and payload JSON.
3. Validate timestamps and expected claims.
4. Fix upstream token generation if needed.

Common pitfalls

• Misconfigured expiration times
• Wrong audience or issuer
• Claims missing or named incorrectly

Security notes

• Decoding does not verify the signature.
• Do not paste production tokens into unknown tools.
• Always verify tokens on the server.

Checklist

• Header algorithm matches your auth config
• exp is in the expected time range
• iss and aud are correct
• Roles and scopes match expected values

FAQ

Does decoding validate the token? No. It only displays the contents.

Is the signature checked? No. Use your backend or auth service for verification.

Can I decode custom claims? Yes. All claims show in the payload JSON.

Try the tool