How to Decode a JWT with JWT Decoder

Introduction

JSON Web Tokens (JWTs) are a compact way to represent claims between parties. They are commonly used for authentication and authorization in web applications. A JWT is composed of three base64url-encoded parts separated by dots: a header, a payload, and a signature.

JWT Decoder is a simple developer tool that decodes the header and payload portions of a JWT so you can inspect their contents. Importantly, the tool decodes tokens without verification of the signature. That means it shows what the token contains but does not validate whether the token is authentic or unmodified.

This tutorial shows how to use JWT Decoder to decode a token, interpret common fields you will see, and offers safety and troubleshooting tips for routine use.

Preparation

Before decoding a JWT, make sure you have the token string available. A typical JWT looks like three dot-separated sections, for example: header.payload.signature. You only need the full token string to paste into the tool.

Decoding does not require any credentials or keys because the signature is not verified. However, avoid pasting tokens that grant access to production systems or contain sensitive personal data unless you are certain the environment where you paste them is secure.

Open the JWT Decoder tool by selecting the provided link in this article or navigating to the tool route. No account or configuration is required to decode a token with the tool.

Steps

Follow these practical steps to decode and inspect a JWT using JWT Decoder. Each step focuses on safe, effective inspection of the header and payload.

1. 1

   Open the JWT Decoder tool

   Use the tool route to open JWT Decoder. The interface provides a single input area where you can paste the entire JWT string.

2. 2

   Paste the JWT into the input field

   Copy the token string you want to inspect and paste it into the tool’s input. Ensure you paste the full token including its dot separators. Do not modify the token before decoding or you may produce a malformed value.

3. 3

   Decode the token

   Trigger the decoder action available in the interface. The tool will decode the header and payload sections and display them in a readable format. Remember the tool decodes without verifying the token signature, so the display shows contents but not authenticity.

4. 4

   Inspect the header

   The header typically contains the token type and the algorithm used for the signature (for example, the alg field). Reviewing header fields helps you understand how the token was intended to be created.

5. 5

   Inspect the payload

   The payload contains claims such as issuer, subject, audience, and expiry fields when present. Use the decoded payload to check claim names and values. Treat any sensitive fields with caution and avoid sharing decoded content publicly.

6. 6

   Apply additional inspection steps if needed

   If you need to interpret timestamps or nested JSON, copy the decoded JSON into your preferred formatter or viewer. For claims representing timestamps, convert numeric values into human-readable date/time using a trusted converter if required.

7. 7

   Close the session and clear sensitive data

   After you finish, clear the input and any decoded output in the tool interface, especially when working with tokens from shared or public devices. This reduces the risk of unintentional exposure.

Result

After decoding, you will see two main decoded JSON documents: the header and the payload. The header explains metadata about the token, such as the algorithm used to sign it. The payload lists claims which are assertions about an entity (for example, a user) and may include standard fields like issuer (iss), subject (sub), audience (aud), issued-at (iat), and expiration (exp) when they are present.

Because JWT Decoder does not verify signatures, the presence of expected fields or values does not guarantee the token is valid or unmodified. Use decoded results to confirm structure and claim names, to debug token generation, or to review what a token conveys for development and testing purposes.

If you require verification that a token is authentic, use a server-side library or tool that checks the token signature against a trusted key or secret as part of your application’s authentication flow.

Privacy and Responsible Use

Because JWT Decoder shows the token’s contents without verifying its signature, do not use it to handle tokens that grant sensitive access or contain personal data unless you explicitly control the environment where you paste them. Treat tokens as secrets when they grant access to services.

Avoid pasting production tokens, API keys, or tokens containing personal data into any third-party tool or a public computer. If you must inspect a sensitive token, prefer doing so in a secure, private environment and clear the tool’s input and output when finished.

Responsible use also includes respecting copyright and data protection obligations. Only inspect tokens you are authorized to use or analyze. Do not use the tool to access, modify, or publish data you are not permitted to handle.

Common Errors and Troubleshooting

Decoding a JWT is straightforward, but several common issues can prevent a successful decode or lead to confusing output. The list below helps you identify and resolve typical problems.

1. 1

   Malformed token or missing parts

   A JWT must contain three parts separated by dots. If the token is missing sections or the separators, decoding will fail or produce errors. Confirm you copied the entire token string including dots.

2. 2

   Invalid base64url encoding

   Header and payload are base64url-encoded JSON. If the token uses incorrect padding or contains characters not valid in base64url, the decoder may not be able to parse the content. Verify the token origin and ensure it was copied exactly.

3. 3

   Non-JSON payloads

   Some tokens include non-standard or binary content in sections. If the decoded bytes are not valid JSON, the tool may show unreadable output. In such cases, inspect the raw decoded text or use a specialized viewer for the content type.

4. 4

   Misinterpreting decoded data as verification

   Seeing expected claims in decoded output does not mean the token’s signature verifies. If you need to confirm authenticity, perform signature verification using a trusted library and the appropriate key or secret.

Frequently asked questions