JWT Decoder Tutorial — Inspect Tokens Online
Learn to decode and inspect JWT tokens with our free tool. Understand header, payload, claims, expiration — complete beginner tutorial.
What Is JWT Decoder?
JSON Web Tokens (JWT) are the standard for authentication in modern web applications. Every time you log into an app using OAuth, Google Sign-In, or any token-based auth system, a JWT is created and passed between your browser and the server. But JWTs look like random gibberish — long strings of letters, numbers, and dots. Our JWT decoder lets you peek inside any JWT to see exactly what it contains: who the user is, when the token expires, what permissions it grants, and which algorithm signed it. This tutorial teaches you to decode, read, and debug JWTs like a pro.
The Problem This Solves
Your application is getting 401 Unauthorized errors, tokens are expiring unexpectedly, or you need to verify what claims a JWT actually contains — but the raw token is an unreadable Base64 string that tells you nothing at a glance.
Why This Matters
JWTs power authentication for billions of API requests daily. They're used by Auth0, Firebase, AWS Cognito, Okta, and virtually every OAuth 2.0 implementation. Developers who can quickly decode and inspect JWTs debug auth issues 10x faster. Understanding JWT structure (header, payload, signature) is essential knowledge for any backend or fullstack developer working with APIs.
Getting Started — Step by Step
Get your JWT token
Find the JWT you want to inspect. Common locations: browser DevTools → Network tab → look for Authorization: Bearer eyJ... headers, your application logs, API testing tools like Postman, or cookie values. A JWT always starts with eyJ (Base64 for {").
Paste into the JWT Decoder
Open the JWT Decoder and paste the entire token into the input field. The tool instantly splits it into three color-coded parts: the red header, the purple payload, and the blue signature.
Read the header
The header reveals the token's metadata: alg shows the signing algorithm (HS256, RS256, ES256), and typ confirms it's a JWT. If you see "alg": "none", that's a security red flag — the token isn't signed at all.
Inspect the payload claims
The payload contains the actual data (claims): sub (subject/user ID), email, name, role, iat (issued at timestamp), exp (expiration timestamp), and any custom claims your app adds. The decoder shows timestamps in human-readable format.
Check token expiration
Look at the exp claim — the decoder converts this Unix timestamp to a readable date and tells you if the token is still valid or expired. If your users are getting logged out unexpectedly, the exp value tells you exactly when and why.
Try JWT Decoder Now
Open full page →All processing happens in your browser — your data never leaves your machine.
Real-World Example
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQ1NiIsImVtYWlsIjoiYm9iQGV4YW1wbGUuY29tIiwicm9sZSI6ImVkaXRvciIsImlhdCI6MTcxMjg4MDAwMCwiZXhwIjoxNzEyODgzNjAwfQ.signature_bytes_here
{
"sub": "user_456",
"email": "[email protected]",
"role": "editor",
"iat": 1712880000, // 2026-04-12 00:00:00 UTC
"exp": 1712883600 // 2026-04-12 01:00:00 UTC (1 hour)
}
Pro Tips & Common Mistakes
- 1 JWT tokens always have three parts separated by dots. If yours doesn't, it's not a valid JWT.
- 2 The decoder shows payload data but does NOT verify the signature — that requires the secret key and must happen server-side.
-
3
Common debugging trick: decode both access token and refresh token to compare their
expvalues. - 4 Never log JWT tokens in production — they may contain personally identifiable information (PII).
Frequently Asked Questions
Is it safe to paste my JWT token into this tool?
Yes. The decoder runs entirely in your browser using JavaScript — no data is sent to any server. However, as a best practice, avoid pasting production tokens that grant real access. Use tokens from development or staging environments when possible.
Can I edit a JWT token with this tool?
This tool is for decoding and inspection only. Editing a JWT payload would invalidate the signature, making the token useless. To create or modify JWTs, you need the signing key and should use a JWT library in your application code.
What does 'alg: none' in the header mean?
The none algorithm means the token has no signature — it's not cryptographically signed. This is a known security vulnerability (CVE-2015-9235). If your application accepts tokens with alg: none, it's accepting unsigned tokens anyone could forge. Always reject none algorithm tokens in production.
Related Getting Started Guides
Related Tools
Ready to use JWT Decoder?
Free, no signup required. Works entirely in your browser.
Open JWT Decoder →