JWT Token Decoder: How to Decode & Debug JSON Web Tokens

Updated March 2026 · 7 min read

JSON Web Tokens (JWTs) are the standard for authentication and authorization in modern web applications. Whether you are building a REST API, implementing OAuth, or debugging a login flow, understanding how to decode and inspect JWTs is an essential skill for any developer.

What Is a JWT?

A JWT (pronounced "jot") is a compact, URL-safe token format defined by RFC 7519. It allows you to securely transmit information between parties as a JSON object. The token is digitally signed, so the receiver can verify its authenticity.

A JWT looks like this:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkRldlRvb2xLaXQiLCJpYXQiOjE3MTY5MjAwMDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

JWT Structure: Header.Payload.Signature

Every JWT consists of three parts separated by dots (.):

1. Header

The header typically contains the signing algorithm and token type. It is Base64URL-encoded:

{
  "alg": "HS256",
  "typ": "JWT"
}

Common algorithms include HS256 (HMAC-SHA256), RS256 (RSA-SHA256), and ES256 (ECDSA-SHA256).

2. Payload (Claims)

The payload carries the actual data as "claims" — statements about the user and metadata:

{
  "sub": "1234567890",
  "name": "DevToolKit",
  "email": "[email protected]",
  "role": "admin",
  "iat": 1716920000,
  "exp": 1717006400
}

3. Signature

The signature verifies the token has not been tampered with. It is computed using the algorithm specified in the header:

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)

Standard JWT Claims

Claim	Name	Description
`iss`	Issuer	Who issued the token (e.g., your auth server)
`sub`	Subject	The user or entity the token is about
`aud`	Audience	Intended recipient of the token
`exp`	Expiration	Unix timestamp when the token expires
`nbf`	Not Before	Token is not valid before this time
`iat`	Issued At	When the token was created
`jti`	JWT ID	Unique identifier to prevent replay attacks

Use the Unix Timestamp Converter to convert exp and iat values to human-readable dates.

How to Decode a JWT

Open the JWT Decoder tool.
Paste the full JWT string into the input field.
The decoded header and payload appear instantly with formatted JSON.
Check the exp claim to see if the token has expired.
Inspect custom claims like role, scope, or permissions.

Debugging Common JWT Authentication Issues

Token Expired (401 Unauthorized)

The most common issue. Decode the token and check the exp claim against the current Unix timestamp. If exp is in the past, the token has expired and needs to be refreshed.

// exp: 1716920000 = May 28, 2024 16:53:20 UTC
// Current time is past this? Token expired.

Invalid Signature (403 Forbidden)

This happens when the token was signed with a different secret or key than what the server expects. Common causes:

Using the wrong environment's secret (dev vs. production)
Key rotation — the signing key was changed but old tokens are still in use
Token was modified after signing (tampering)

Wrong Audience (aud mismatch)

If the aud claim does not match the expected API or service identifier, the token will be rejected. This is common in multi-service architectures.

Algorithm Confusion Attack

Never trust the alg header blindly. A known attack involves changing alg from RS256 to HS256 and signing with the public key as the HMAC secret. Always validate the algorithm server-side.

JWT Security Best Practices

Keep tokens short-lived — use 15-minute access tokens with longer-lived refresh tokens.
Never store sensitive data in the payload — it is only Base64-encoded, not encrypted. Anyone can read it.
Use strong secrets — generate HMAC secrets with at least 256 bits of entropy. Use a password generator for this.
Validate all claims — check iss, aud, exp, and nbf on every request.
Use HTTPS only — tokens in transit should always be encrypted. Check your SSL setup.
Do not store JWTs in localStorage for sensitive apps — use httpOnly cookies to prevent XSS attacks.

JWT in Different Contexts

# Decode JWT in the terminal
echo "eyJhbGciOiJIUzI1NiJ9" | base64 -d
# Output: {"alg":"HS256"}

# Using jq for pretty output
echo "eyJhbGciOiJIUzI1NiJ9" | base64 -d | jq .

# Python
import jwt
decoded = jwt.decode(token, secret, algorithms=["HS256"])

# Node.js (jsonwebtoken)
const jwt = require('jsonwebtoken');
const decoded = jwt.verify(token, secret);

FAQ

Can I decode a JWT without the secret key?

Yes. The header and payload are only Base64URL-encoded, not encrypted. You can always read them. The secret is only needed to verify the signature.

Is it safe to decode JWTs in the browser?

Yes. DevToolKit's JWT decoder runs entirely client-side. Your tokens are never sent to any server.

What is the difference between JWS and JWE?

JWS (JSON Web Signature) is what most people mean by "JWT" — the payload is signed but readable. JWE (JSON Web Encryption) encrypts the payload, so it cannot be read without the decryption key.

Try JWT Decoder Now →

DevToolKit — 42+ Free Online Developer Tools