JWT Decoder

A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm (alg) and token type (typ); the payload carries the claims — standard ones like iss, sub, exp plus any custom fields; the signature is computed over the first two segments so the token can't be tampered with undetected.

A JWT decoder is useful for reading authentication claims, debugging expiry, checking issuer and audience values, and confirming which algorithm a token declares. Decoding is not the same as verifying. The header and payload are merely encoded, not encrypted — anyone can read them, which is why you should never put secrets in a JWT. Only checking the signature against the issuer's key proves the token is authentic and unaltered. This tool decodes everything client-side and can verify HMAC signatures locally; the token never leaves your machine.

Many HS256 tokens start with the same first segment, eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 , because it is simply the Base64URL form of this common header — which is also why so many JWTs begin with eyJ, the encoding of {":

{
  "alg": "HS256",
  "typ": "JWT"
}

A typical access-token payload decodes to something like:

{
  "iss": "https://auth.example.com",
  "sub": "user-1234",
  "aud": "api.example.net",
  "iat": 1767225600,
  "exp": 1767229200,
  "scope": "read:reports"
}

The status bar shows the algorithm (HS256), the type ( JWT ), the number of segments and an Active or Expired tag. In the Claims panel, iat is rendered as Thu, 01 Jan 2026 00:00:00 GMT and exp as Thu, 01 Jan 2026 01:00:00 GMT , each followed by a relative time such as “in 5 minutes” or “2 hours ago” — so this token was valid for one hour. scope is listed as a custom claim. Use Load sample to fill in a demo HS256 token together with its secret and try the Verify button.

Registered claims are listed first, followed by every other field as a custom claim (for example scope, role or email). Time claims are seconds since 1970-01-01 UTC, not milliseconds; the Unix timestamps guide explains the format, and the Timestamp Converter converts individual values.

The alg header names how the signature was produced. This page can verify only the HMAC family:

Decoding is not verification

The green Valid JWT verdict means only that the header and payload are well-formed Base64URL-encoded JSON. Anyone can edit a payload, re-encode it and paste it here; it will decode just as cleanly. Only a matching signature, checked with the right key, shows the token was issued by the expected party and not altered.

Why alg=none is dangerous

A token with "alg": "none" carries no signature, so anyone can mint one with any claims. A server must never accept it, and should not let the token's own header choose the algorithm: configure the expected algorithm (and key) on the verifier. The same rule prevents algorithm confusion, where an RS256 public key is misused as an HS256 secret.

• Debugging 401 responses — check whether exp has passed, nbf is still in the future, or aud and iss differ from what the API expects.
• Reviewing an integration — confirm which alg an identity provider uses and which custom claims (roles, scopes, tenant IDs) it adds.
• Testing your own HMAC tokens — verify that a development token was signed with the secret you think it was.
• Checking token hygiene — make sure no emails, internal IDs or other sensitive values leak into a payload that every client can read.

• Signature verification covers HS256, HS384 and HS512 only. RSA, RSA-PSS, ECDSA and EdDSA tokens are decoded but not verified, and keys cannot be fetched from a JWKS endpoint.
• Encrypted tokens (JWE) are not decrypted, and only the compact header.payload.signature form is supported, not the JSON serialization.
• The time tags compare exp and nbf with your device clock, without leeway, and only when they are numbers. iat is displayed but not checked.
• iss, aud and custom claims are shown, not validated — the decoder cannot know which values your API expects. A verified signature also does not mean the token is unexpired.