JWT Decoder

What Is a JWT?

A JSON Web Token has three Base64URL parts separated by dots: a header, a payload with claims such as user ID and expiry, and a signature. This tool decodes the header and payload in your browser so you can read them.

When to Use It

• When debugging login or API authentication.
• To check a token's expiry (exp), issuer (iss) or audience (aud).

How to Use It

1. Paste the token.
2. Read the decoded header and payload.

Understanding the Result

Times such as exp and iat are Unix timestamps - convert them with the Unix Timestamp Converter. The alg header shows how the token is signed.

Limitations

Decoding is not verification - the signature is not checked, so never trust a token's contents without verifying it on your server. JWT payloads are readable by anyone; do not put secrets in them.

Example

A JWT looks like three Base64URL strings joined with dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEwNDIiLCJleHAiOjE3OTAwMDM2MDB9.signature

Decoded, the header and payload are:

{ "alg": "HS256", "typ": "JWT" }
{ "sub": "user_1042", "exp": 1790003600 }

Common Claims

Debugging "401 Unauthorized"

• Check exp - an expired token is the most common cause. Convert it with the Unix Timestamp Converter.
• Check aud and iss match what the API expects.
• Check the header alg matches the server's configuration (for example RS256 vs HS256).
• Make sure the header is sent as Authorization: Bearer <token>.

Never put secrets in a JWT payload - anyone can decode it. Read how to decode a JWT for why decoding is not verifying.