JWT Decoder — Decode JSON Web Tokens Instantly

What is a JWT Decoder?

A JWT Decoder (JWT डिकोडर) reads a JSON Web Token and shows what is inside it. JWTs are everywhere in modern apps: when you log in to a website or mobile app, the server often gives your browser a token like eyJhbGciOiJIUzI1NiIs… that proves who you are on later requests. APIs accept them in the Authorization: Bearer header, single sign-on systems such as Google, Firebase, Auth0 and AWS Cognito issue them as ID tokens, and webhooks and microservices pass them between servers.

Each token carries claims — the user's ID, their email or role, who issued the token, who it is meant for and when it expires — encoded in Base64URL so it can travel safely in URLs and headers. This free decoder turns a token back into readable JSON, explains the standard claims, converts the timestamp claims into real dates, tells you whether the token has expired, warns about unsafe settings and, for HMAC-signed tokens, can verify the signature with your secret. All of this happens in your browser; the token is never uploaded.

Key Features

• Header and payload decoded and pretty-printed as JSON.
• UTF-8 safe — names and claims in Hindi or other languages display correctly.
• Claim table with plain-English meanings for registered claims.
• Dates — exp, iat, nbf and auth_time in UTC and local time, with “in 2 h” or “3 days ago”.
• Status — expired, not yet valid or still valid.
• Warnings for alg none and for encrypted (JWE) tokens.
• HMAC verification for HS256, HS384 and HS512.
• “Bearer ” prefix removed automatically.

How to Decode a JWT — Step by Step

1. Copy the token from your browser's developer tools, an API response, a cookie or a log.
2. Paste it into the box; the result appears instantly.
3. Read the status line for the algorithm and expiry.
4. Inspect the header and payload JSON and the claim table.
5. To verify an HS256/384/512 token, enter the shared secret. The sample token on this page is signed with the secret promptminds-secret, so you can try it.

The Three Parts of a JWT

The three parts are joined with dots. Because only the signature depends on a secret or private key, anyone can decode the first two parts — which is why JWT payloads must never contain passwords, card numbers or other secrets.

Registered Claims Explained

Time claims are Unix timestamps in seconds. For example, exp 4102444800 is 1 January 2100 00:00 UTC — the far-future expiry used in this page's sample token. Our Timestamp Converter converts any such value.

Decoding vs Verifying

Decoding answers “what does this token say?”. Verifying answers “can I trust what it says?”. To verify, a server recomputes the signature over header.payload with the shared secret (HS256) or checks it with the issuer's public key (RS256, ES256), then validates exp, nbf, iss and aud. Only after all checks pass should it act on the claims. This tool can perform the HMAC part of verification for testing; for public-key algorithms, use your server library and the issuer's JWKS endpoint.

Common JWT Security Pitfalls

• Accepting alg none — an attacker can strip the signature. Always require a specific algorithm.
• Algorithm confusion — servers that accept both RS256 and HS256 may be tricked into using the public key as an HMAC secret. Pin the expected algorithm.
• Weak HMAC secrets — short secrets can be brute-forced from a captured token. Use at least 256 random bits.
• Long-lived tokens — keep access tokens short (minutes to hours) and use refresh tokens.
• Storing tokens in localStorage — any XSS can steal them; consider HttpOnly cookies.
• Sensitive data in the payload — it is readable by anyone who sees the token.

Where to Find a JWT

• Browser developer tools → Network tab → a request's Authorization header.
• Application / Storage tab → cookies, localStorage or sessionStorage.
• API responses from login endpoints (often access_token and id_token fields).
• Mobile app logs or proxy tools while debugging.
• Firebase — await user.getIdToken() returns an ID token you can paste here.

How This Decoder Works

The tool removes a leading “Bearer ”, splits the token on dots, converts each Base64URL part back to bytes (adding padding and swapping - and _ for + and /), decodes the bytes as strict UTF-8 and parses them as JSON. Errors are reported precisely — for example if a part contains characters that are not Base64URL or is not valid JSON. Expiry status is calculated against your device's clock. For HS256/384/512 it imports your secret with the Web Crypto API, computes the HMAC of header.payload and compares the Base64URL result with the token's signature.

Access Tokens, ID Tokens and Refresh Tokens

Login systems based on OAuth 2.0 and OpenID Connect usually issue several tokens. The ID token is always a JWT and describes the user (name, email, sub) for the client app. The access token is sent to APIs; it is often a JWT but can be an opaque random string that only the issuer understands — those cannot be decoded here. The refresh token is long-lived, should be stored securely, and is exchanged for new access tokens when they expire. If a token will not decode, it is probably opaque rather than broken.

Common Uses

• Debugging “401 Unauthorized” errors by checking exp, aud and iss.
• Checking which roles or scopes a token grants.
• Comparing ID tokens from different identity providers.
• Verifying HS256 webhook or service tokens during development.
• Learning how authentication tokens are built.
• Confirming clock-skew issues between servers.
• Checking that a new release still issues tokens with the expected claims.

Common Mistakes to Avoid

• Trusting decoded claims in the browser for security decisions — always verify on the server.
• Pasting production tokens into unknown websites — a token is a temporary password.
• Treating exp as milliseconds — JWT times are in seconds.
• Ignoring clock skew — allow a minute or two of leeway between servers.
• Using the same secret everywhere — rotate and scope secrets.

Troubleshooting

• “A JWT has 3 parts” — the token was cut off or has extra text; copy it again in full.
• “not valid Base64URL JSON” — the token may be an opaque access token, not a JWT.
• Signature does not match — wrong secret, a modified token, or the secret is Base64-encoded on the server (enter the decoded secret).
• Expired but the app still works — the app may refresh tokens automatically or check a different token.

Quick Glossary

• JWT: JSON Web Token (RFC 7519).
• JWS / JWE: signed / encrypted token formats.
• Claim: a piece of information in the payload.
• HMAC: keyed hash used by HS256/384/512.
• JWKS: a JSON set of public keys used to verify RS/ES tokens.
• Bearer token: a token that grants access to whoever holds it.
• Base64URL: URL-safe Base64 without padding, used for every JWT part.
• Clock skew: small time differences between servers that can make fresh tokens look expired.

Why Use This JWT Decoder?

It decodes any JWT instantly, explains claims and expiry in plain language, flags dangerous settings, verifies HMAC signatures and keeps your token on your device — free and without sign-up.

JWT Decoder — Key Facts

Frequently Asked Questions

Explore More Prompt Minds Tools

JWT Decoder works great alongside our other free tools. Every Prompt Minds tool runs entirely in your browser — no sign-up, no uploads, no watermarks. Browse all free tools.