JWT Decoder & Verifier
Decode header and payload, inspect claims, check expiry.
Decoded locally in your browser. The token is never transmitted.
Join the Veojson dispatch
Get the weekly Veojson dispatch: one sharp note on web tech, security and developer tooling.
One email, no spam, unsubscribe any time.
About this tool
A JSON Web Token is three base64url segments separated by dots: header, payload and signature. This decoder splits and decodes the first two locally so you can read the claims, verify the algorithm, and see whether the token has expired.
How to read a JWT
The header declares the signing algorithm (alg) and key id (kid). The payload holds registered claims such as iss, sub, aud, exp, iat and nbf, plus any custom claims your application adds. The signature is verified server-side with the signing key — decoding alone never proves a token is authentic.
Is decoding a JWT the same as verifying it?
No. Anyone can decode a JWT because the payload is only base64url-encoded, not encrypted. Verification requires the secret or public key. Never place sensitive data in a JWT payload.
How to use JWT Decoder & Verifier
- 1
Paste the token
Copy the full `xxxxx.yyyyy.zzzzz` string from your Authorization header, cookie or API response and paste it into the input box.
- 2
Read the header
Confirm the signing algorithm and the key id (`kid`) match what your identity provider is supposed to issue.
- 3
Inspect the claims
Check subject, issuer, audience, scopes/roles, and the human-readable issued-at and expiry timestamps.
- 4
Act on expiry
If the token is expired, refresh it. If claims look wrong, compare against your IdP configuration before debugging application code.
Example input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NSIsIm5hbWUiOiJBZGEiLCJleHAiOjE3NTAwMDAwMDB9.sig
Expected output
{ "alg": "HS256", "typ": "JWT" }
{ "sub": "12345", "name": "Ada", "exp": 1750000000 } → expiredBest practices
- Never paste a production token that is still valid into any online decoder you do not control — treat every token as a live password until it expires.
- Always check the `alg` header. Reject `none` and, for public APIs, prefer asymmetric algorithms (RS256/ES256) over shared-secret HS256.
- Validate `exp`, `nbf`, `iat`, `iss` and `aud` server-side on every request. Decoding proves nothing — only signature verification does.
- Keep access tokens short-lived (5–15 minutes) and push long sessions onto rotating refresh tokens.
- Do not store personal data or secrets in the payload: a JWT is signed, not encrypted, and anyone holding it can read every claim.
Why JWT Decoder & Verifier matters
JWTs sit in front of nearly every modern API, so a single misread claim can mean an outage, a broken login flow, or a silent authorisation bug.
Most real-world JWT incidents come from accepting unverified tokens, `alg: none` confusion, or over-long expiry — all of which are visible the moment you look inside the token.
Related free & paid tools
| Tool name | Type | Key features | Link |
|---|---|---|---|
| jwt.io | Free | Classic decoder with signature verification | Visit |
| Authgear JWT Debugger | Free | JWE support and advanced claim inspection | Visit |
| Auth0Offer | Freemium | Hosted IdP that issues, rotates and verifies JWTs | Visit |
| Keycloak | Free | Self-hosted OIDC provider with full JWT support | Visit |
Links marked Offer may be partner links. They cost you nothing extra and never affect which tools we recommend.