What Is a JWT Token? How to Decode One Online

Learn what a JSON Web Token (JWT) is, how its header, payload and signature work, and how to decode and inspect a JWT online in seconds without any backend.

If you've ever opened your browser's dev tools and seen a long string like eyJhbGciOiJIUzI1NiIs... in a cookie, an Authorization header, or a localStorage entry, you've run into a JWT token. This guide explains what a JWT actually is, what's hiding inside it, and how to decode one online in a few seconds.

What is a JWT?#

JWT stands for JSON Web Token. It's a compact, URL-safe way to represent a set of claims (facts) as a signed piece of text, most commonly used to prove who a user is after they log in. Instead of a server storing a session in memory or a database, it hands the client a token that encodes the user's identity, and the client sends that token back with every request.

A JWT is not encrypted by default — it's just encoded and signed. Anyone who has the token can read its contents; the signature only proves the token wasn't tampered with (assuming the signing key is kept secret). This is the single most important thing to understand about JWTs: don't put secrets inside the payload.

The three parts of a JWT#

A JWT always looks like three Base64Url-encoded segments joined by dots:

header.payload.signature

Each of the first two parts is just Base64Url-encoded JSON — no encryption involved. That's why any JWT decoder can instantly show you the raw claims.

How to decode a JWT online#

You don't need a backend, a CLI tool, or to paste your token into a random website that might log it. The JWT Decoder runs entirely in your browser:

1. Open the JWT Decoder tool.
2. Paste your token into the text box (format: xxxxx.yyyyy.zzzzz), or click Sample Token to try a demo JWT.
3. The tool splits the token into Header, Payload and Signature, and renders the header and payload as readable key-value pairs.
4. Time-based fields (exp, iat, nbf) are automatically converted into a human-readable date and a relative time like "in 2 hours" or "3 days ago", so you don't have to manually convert Unix timestamps.
5. A status line at the top tells you whether the token is Valid, Expiring soon, or Expired, based on exp compared to your current clock.
6. Click Copy next to Header or Payload to grab the formatted JSON for your own notes or a bug report.

Because everything happens client-side, your token never leaves your browser — which matters, since a JWT often carries a live session credential.

Common JWT fields explained#

If you see custom fields beyond these (roles, permissions, tenant IDs), that's normal — JWT payloads are just JSON objects, and applications add whatever claims they need.

Why "decode" is not "verify"#

This is the part that trips people up most: decoding a JWT tells you what it claims, not whether those claims are trustworthy. Verifying a JWT means recomputing the signature with the correct secret or public key and checking it matches. A decoder like this one deliberately does not verify the signature — it only shows you the Base64Url-decoded contents, exactly as jwt-decoder does, flagging clearly that the signature is unverified.

In practice this means:

• Great for debugging: checking why your API call is failing, confirming which user/role a token represents, or seeing when a session will expire.
• Not a security check: never trust a decoded payload as proof of identity in your own backend code. Server-side verification against the actual signing key is a separate, mandatory step.

If you're building an app, JWT verification should happen in your backend framework or auth library, using the secret/public key — never by trusting a client-side decode.

Debugging tips with a JWT decoder#

• "Token expired" errors: paste the token and check the exp relative time. If it says "2 hours ago," the fix is to refresh the token, not to debug your API logic.
• Wrong permissions: check the payload for role, scope, or custom claims — a common bug is the frontend caching an old token after a role change.
• Malformed token errors: if the decoder reports an invalid format, make sure you copied all three dot-separated segments and didn't accidentally include a Bearer prefix or trailing whitespace.
• Timestamp confusion: exp/iat are Unix seconds, not milliseconds. If you need to convert a raw timestamp elsewhere, the Timestamp Converter handles both directions.
• Manual Base64 curiosity: since JWT segments are just Base64Url, you can also decode a single part manually with a Base64 Codec if you want to see the raw encoding step.

Frequently asked questions#

Is it safe to paste a JWT into an online decoder?

It's safe with a tool that runs fully in the browser and never sends the token to a server, which is how the JWT Decoder here works — the string is parsed and decoded locally with atob/JSON.parse, nothing is uploaded. Avoid tools that don't disclose this, especially for production tokens.

Can I edit a JWT and re-sign it in this tool?

No. This decoder is read-only by design — it shows you the header and payload but doesn't let you modify and re-sign a token, since that would require the private signing key and isn't a legitimate client-side operation.

Why does my payload contain fields I didn't expect?

Auth providers often add standard claims automatically (iss, aud, iat) on top of whatever your backend put in. This is normal JWT behavior, not a bug.

What does "signature not verified" mean exactly?

It means the tool decoded the header and payload text but did not check the cryptographic signature against a key. The signature itself is still shown as a raw string so you can compare it manually if needed.

Is a JWT the same as an API key?

No. An API key is typically a static, opaque secret. A JWT is a structured, self-contained token that carries claims and has a built-in expiry, which is why it's popular for session/auth flows rather than long-lived API access.

How do I know which algorithm signed my token?

Check the alg field in the decoded header — common values are HS256 (HMAC with a shared secret) and RS256 (RSA with a public/private key pair).

Summary#

A JWT is just three Base64Url-encoded segments — header, payload, signature — glued together with dots. Decoding one is instant and doesn't require a server; verifying one requires the signing key and is a separate concern entirely. Next time you need to inspect a token, paste it into the JWT Decoder to see its claims and expiry at a glance, right in your browser.