JWT Decoder Online: How to Decode and Inspect a JWT

What is a JWT decoder?

A JWT decoder converts the readable parts of a JSON Web Token from Base64Url-encoded text into JSON. A JWT normally has three dot-separated sections:

header.payload.signature

The header describes the token type and algorithm. The payload contains claims such as the subject, issuer, audience, and expiration time. The signature is used for verification, but it is not decoded into useful JSON.

Use the DevToolkit JWT Decoder to inspect a token directly in your browser. The tool does not upload or log the token.

How to decode a JWT

1. Copy the complete token from an API response or authorization header.
2. Paste it into the JWT Decoder.
3. Inspect the header for alg and typ.
4. Inspect the payload for claims such as iss, sub, aud, iat, and exp.
5. Compare the values with the authentication server and API configuration.

For example, a token payload might look like this:

{
  "iss": "https://auth.example.com",
  "sub": "user_123",
  "aud": "api",
  "iat": 1726387800,
  "exp": 1726391400
}

The exp value is a Unix timestamp. It indicates when the token should stop being accepted, but the API must enforce that rule during verification.

Decode versus verify

Decoding only reads the token. Anyone who has a JWT can usually decode its header and payload because Base64Url encoding is reversible. Verification proves that the token was signed by a trusted issuer and has not been changed.

Never authorize a request because a token decoded successfully. The backend should verify the signature, algorithm, issuer, audience, and expiration before trusting the claims. Read what JWT means and how it works for the complete structure.

Decode a JWT with JavaScript

For development-only inspection, a browser can decode the payload like this:

function decodeJwtPayload(token) {
  const [, encodedPayload] = token.split(".");
  const normalized = encodedPayload.replace(/-/g, "+").replace(/_/g, "/");
  const json = decodeURIComponent(
    atob(normalized)
      .split("")
      .map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`)
      .join("")
  );
  return JSON.parse(json);
}

This function does not validate the signature. Do not use decoded values as an authentication decision.

JWT inspection checklist

• Does the token contain exactly three sections?
• Is the declared algorithm allowed by the server?
• Is exp still in the future?
• Do iss and aud match the expected service?
• Is the server clock synchronized?
• Are you testing with a token from the correct environment?

For related encoding behavior, see Base64 encoding versus encryption. Base64Url makes JWT parts transport-safe; it does not make them secret.

Summary

A JWT decoder is a debugging tool for reading token structure and claims. It cannot verify authenticity, replace backend security, or make an expired token valid. Use the online JWT Decoder for local inspection, then verify tokens on the server.