ToolMight LogoToolMight

JWT Decoder

Decode and inspect JSON Web Tokens (JWTs) directly in your browser. View the decoded header, payload claims, timestamps, and signing metadata without sending the token to ToolMight's servers.

Loading Tool...

Learn About This Tool

JWT structure: header, payload, and signature

Decoding a JWT does not verify it.JWT headers and payloads are Base64URL-encoded, so they can be decoded without the signing key. Signature verification is a separate cryptographic operation that requires the appropriate key.

A JSON Web Token (RFC 7519) consists of three dot-separated Base64URL segments:

header.payload.signature

// Example Base64URL token string:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.Vx4Ypnk5FjmF_UJOy2mQW3eQhHI9xyfe3mBG0OGTGCU
  • Header: Contains metadata such as the signing algorithm (alg), token type (typ), and optional key ID (kid)
  • Payload: Contains application claims, user context, and token metadata
  • Signature: Used by a verifier to check token integrity and authenticity

JWT headers and signing algorithms

The header specifies metadata used to process the token. The alg parameter identifies the algorithm used to sign the token:

  • HS256 (HMAC SHA-256): Uses a shared secret key for both signing and verification.
  • RS256 / ES256 / PS256: Uses an asymmetric key pair (private key to sign, public key to verify).

The optional kid (Key ID) header parameter indicates which key a verifier should select (for example, matching an entry in a JWKS endpoint). ToolMight's decoder parses the header parameters from Base64URL but does not retrieve remote keys or verify signatures. Header JSON can also be formatted using our JSON Formatter.

// Decoded Header Example
{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "auth-key-2026-01"
}

JWT claims and expiration

The payload contains claims—statements about an entity (typically a user or service) and additional metadata. RFC 7519 defines standard registered claim names:

ClaimMeaningTypical use
issIssuerIdentifies the authority that issued the token (e.g., https://auth.example.com).
subSubjectIdentifies the principal subject of the token (e.g., user_123).
audAudienceIdentifies the intended recipients or target API service.
iatIssued AtUnix timestamp indicating when the token was created.
nbfNot BeforeUnix timestamp indicating when a verifier may begin accepting the token.
expExpirationUnix timestamp indicating when a verifier must reject the token.

A verifier uses these claims during authentication to validate timing and recipient constraints. Below is a realistic decoded payload structure:

// Decoded Payload Example
{
  "sub": "user_123",
  "name": "Jane Doe",
  "roles": ["admin", "developer"],
  "iss": "https://auth.example.com",
  "aud": "api.example.com",
  "iat": 1772496000,
  "exp": 1772582400
}

Base64URL encoding

JWT segments use Base64URL encoding (RFC 4648 §5) rather than standard Base64 to ensure tokens can be safely included in HTTP headers, cookies, and URL query strings:

  • + is replaced with -
  • / is replaced with _
  • Trailing = padding characters are omitted

To decode Base64URL strings programmatically, padding must be restored before standard Base64 decoding. For general string encoding, view our Base64 Decoder.

// Base64URL Padding Restoration in JavaScript
function padBase64Url(input) {
  let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
  while (base64.length % 4) {
    base64 += '=';
  }
  return base64;
}

How to Use JWT Decoder

1

Paste your JWT

Paste the compact JWT string into the input field.

2

Inspect the header and payload

The decoder separates the token into its segments and displays the decoded JSON.

3

Check timestamps and claims

Review fields such as exp, iat, and nbf to understand the token's timing.

4

Inspect signing metadata

Review alg, typ, and kid when troubleshooting authentication or token configuration.

Code Implementations

Copy & paste production-ready code snippets for JWT Decoder in your language of choice

File: decode_jwt.py
Python
import json
import base64

def decode_jwt_payload(token: str) -> dict:
    parts = token.split('.')
    if len(parts) != 3:
        raise ValueError("Invalid JWT token format")
    payload_b64 = parts[1]
    payload_b64 += '=' * (-len(payload_b64) % 4)
    decoded_bytes = base64.urlsafe_b64decode(payload_b64)
    return json.loads(decoded_bytes)

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
print(decode_jwt_payload(token))

Frequently Asked Questions

The decoder processes the token in your browser and does not send the token to ToolMight's servers. Processing occurs entirely in client-side memory.
JWT payloads in JWS tokens are encoded with Base64URL, not encrypted. Anyone who has the token string can decode the header and payload. The secret key is required for signature verification, not for reading the payload claims. JWE (JSON Web Encryption) is used when payload data must be encrypted.
Decoding parses the Base64URL segments to display the JSON header and payload claims. Verification computes the cryptographic signature using a secret key or public certificate to ensure the token has not been altered.
The alg: none header indicates an unsigned token. Applications should not accept unsigned tokens unless that behavior is explicitly required and safely handled. Verification code should also prevent an attacker from selecting an unintended algorithm.
JWS (JSON Web Signature) tokens contain readable, signed claims. JWE (JSON Web Encryption) tokens encrypt the payload content so it cannot be read without a decryption key.
A JWKS (JSON Web Key Set) is a set of JSON-encoded public keys published by an issuer. The kid (Key ID) header parameter tells a verifier which key in the JWKS array corresponds to the token signature.
The character sequence eyJ is the Base64URL encoding of {"alg":. Because standard headers begin with the alg key, most encoded JWT tokens start with eyJ.

Related tools

JSON Formatter & Validator

Popular

Format, validate, and minify JSON data instantly.

UUID Generator

Popular

Generate secure bulk v1, v4, and v7 UUIDs.

Hash Generator

Popular

Create secure MD5, SHA-256, and SHA-512 hashes.

CSV to JSON Converter

Popular

Convert CSV sheets to structured JSON arrays.

Deep Dives & Guides

Master this tool with our expert tutorials and best practices.

3 min readArticle

JWT Architecture: Refresh Token Rotation and Key Management in Production

A deep dive into JSON Web Tokens (RFC 7519), token structure, signature verification, XSS/CSRF mitigation, and production refresh token key rotation architectures.

Read Full Guide
3 min readArticle

JWT Decoding: Understanding JSON Web Tokens Safely

A comprehensive guide on what JSON Web Tokens are, how they are structured, and how to safely decode them for debugging. Includes a security checklist for authentication.

Read Full Guide