Understanding JWT Structure
A JWT consists of three parts separated by dots: Header.Payload.Signature. The header specifies the signing algorithm (typically HS256 or RS256) and token type. The payload contains claims — key-value pairs carrying information about the user, session, or authorization. The signature is a cryptographic hash that verifies the token has not been tampered with. Both the header and payload are Base64URL-encoded JSON objects, which is why they appear as opaque strings until decoded.
- Header — specifies the signing algorithm (HS256, RS256, ES256) and token type (JWT)
- Payload — contains claims: user identity, roles, permissions, expiration, and custom data
- Signature — cryptographic hash for integrity verification (not decoded by this tool)
- Standard claims: exp (expiration), iat (issued at), sub (subject), iss (issuer), aud (audience)
- Custom claims: any application-specific data like roles, organization IDs, or feature flags
Why Offline Decoding Matters for Security
JWTs are bearer tokens — anyone who possesses a valid JWT can use it to authenticate as the associated user. This means a leaked production JWT is equivalent to a leaked password, except potentially worse because JWTs often carry additional authorization claims. Online JWT decoders that send tokens to their servers create an unnecessary attack surface. Even if the service claims not to log tokens, network traffic could be intercepted, servers could be compromised, or employees could have unauthorized access.
Never paste production JWTs into online decoders that make network requests. A compromised JWT can be used to impersonate users, access protected APIs, and escalate privileges. Our tool makes zero network requests — verify this in your browser DevTools.
How to Use the JWT Decoder
Decoding a JWT takes seconds. Paste your token and instantly see the decoded contents in a formatted, readable view.
- Step 1: Paste your complete JWT string (including all three dot-separated parts)
- Step 2: The tool instantly splits, decodes, and formats the header and payload
- Step 3: Review the claims — timestamps are automatically converted to readable dates
- Step 4: Copy individual claims or the entire decoded payload for debugging
This tool decodes and displays JWT contents. It does not verify signatures, as that would require access to the signing secret or public key, which should never be exposed in a client-side tool.
Common Debugging Scenarios
JWT decoding is essential for debugging authentication flows. Common scenarios include checking if a token has expired (comparing the exp claim to the current time), verifying that the correct user ID appears in the sub claim, confirming that role-based access control claims match expected values, inspecting tokens from third-party identity providers like Auth0, Okta, or Firebase to understand what claims they provide, and debugging "401 Unauthorized" errors by examining the token that was rejected.
Decode Your Tokens Without Risk
Our offline JWT Decoder gives you full visibility into your token contents without exposing them to any third-party service. Safe for production tokens, development tokens, and everything in between. Paste, decode, and inspect — with zero network requests and complete privacy. Try it now and make JWT debugging safer and faster.