Decode JSON Web Tokens (JWT) locally. Extract header information, claims, and data payloads without sharing keys.
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The decoding process involves breaking down the token into its three constituent parts: the Header, the Payload, and the Signature, each separated by a dot (.). Because the first two sections are merely Base64Url encoded, a JWT Decoder can reveal the underlying JSON data without requiring the secret key used for signing.
The decoder operates by isolating the three segments of the token. The header typically contains the token type (JWT) and the signing algorithm (e.g., HS256 or RS256). The payload contains the claims, which are statements about an entity (typically the user) and additional data. The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.
Our JWT Decoder provides a comprehensive suite of tools for developers to audit their authentication flow. Key capabilities include:
exp (expiration time), iat (issued at), and sub (subject).To decode a token manually or via a tool, you follow a specific sequence. First, paste the encoded string into the decoder. The tool splits the string at the dots. It then applies a Base64Url decoding algorithm to the first two segments. For developers wanting to implement this programmatically, the following JavaScript example demonstrates how to decode the payload without a library:
const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpmeU0S6S6f3sS6';
const base64UrlToken = token.split('.')[1];
const base64 = base64UrlToken.replace(/-/g, '+').replace(/_/g, '/');
const jsonPayload = decodeURIComponent(atob(base64).split('').map(function(c) { return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2); }).join(''));
console.log(JSON.parse(jsonPayload));Alternatively, using Python's PyJWT library allows for both decoding and verification:
import jwt
# Decoding without verification (similar to the tool)
decoded_payload = jwt.decode(token, options={'verify_signature': False})
print(decoded_payload)It is critical to distinguish between decoding and verifying. Decoding only reveals the content of the token; it does not prove the token is authentic. Never paste tokens containing sensitive administrative credentials into untrusted online decoders. Our tool processes data client-side to ensure that your tokens are not transmitted to a remote server, maintaining the integrity of your session data and reducing the risk of token interception.
This tool is engineered for a diverse set of technical roles:
Decoding is the process of converting the Base64Url encoded segments of the token back into a readable JSON format; this requires no secret key and does not prove authenticity. Verifying, however, involves using a secret key or public key to check the signature against the header and payload. Verification ensures that the token was signed by a trusted source and has not been tampered with since its issuance.
This typically occurs because JWTs use Base64Url encoding, which differs slightly from standard Base64 by replacing '+' with '-' and '/' with '_'. If a decoder does not specifically handle the URL-safe alphabet or fails to account for padding characters (=), the resulting string may be corrupted. Our tool utilizes a strict Base64Url implementation to ensure the JSON output remains clean and accurate.
Generally, it is risky to paste production tokens into any web-based tool because tokens often contain sensitive user data or session identifiers. If a tool sends the token to a backend server, that server could potentially log your token and hijack your session. You should only use decoders that perform all operations locally in your browser via JavaScript, or better yet, use local CLI tools for production environments.
No, a decoder cannot reveal the secret key. The secret key is used to create the signature, not to encode the payload. While the payload is visible to anyone who has the token, the secret key remains hidden. To find the secret key, an attacker would need to perform a brute-force or dictionary attack against the signature, which is a computationally expensive process for strong keys.
The most critical registered claims are 'sub' (Subject), which identifies the user; 'exp' (Expiration Time), which tells you when the token becomes invalid; and 'iat' (Issued At), which marks the token's creation. You should also check for 'iss' (Issuer) to verify which authority granted the token and 'aud' (Audience) to ensure the token was intended for your specific application.
Extremely large JWTs usually occur when too many custom claims or large permission sets are embedded in the payload. If a decoder struggles, it is often due to browser memory limits or string length constraints in the JavaScript engine. In such cases, it is recommended to use a programmatic approach with a library like PyJWT in Python or jsonwebtoken in Node.js to handle the stream of data more efficiently.