JWT Decoder and Inspector
Paste a JSON Web Token to see its decoded header and payload, with expiry and issued-at timestamps translated into human-readable dates. Optionally supply a key to verify the signature. Built for debugging login flows and API auth without writing throwaway scripts.
How to use
- Paste the full JWT (the three dot-separated Base64 segments).
- Read the decoded header and payload, with exp/iat/nbf shown as dates.
- Optionally paste the signing key or public key to verify the signature.
- Check whether the token is expired and whether claims match what your app expects.
A JWT is three Base64URL-encoded segments joined by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two parts. Crucially, the header and payload are only encoded, not encrypted, anyone holding a JWT can read every claim inside it without any key. The signature's job is purely to prove the token wasn't modified and was issued by the key holder.
That design has direct consequences. Never put secrets, passwords or sensitive personal data in JWT claims. Always check the registered claims: exp (expiry) and nbf (not-before) are Unix timestamps, and the single most common JWT bug in production is a server clock a few minutes off rejecting valid tokens, which is why libraries offer a leeway parameter. iss (issuer) and aud (audience) should be validated too, or a token minted for one service can be replayed against another.
Algorithm choice matters more than most tutorials admit. HS256 is symmetric, the verifying service can also mint tokens, fine for a monolith, risky across teams. RS256/ES256 are asymmetric, letting services verify with a public key they cannot sign with. And any decent library must reject alg none tokens outright. Accepting them was a famous class of vulnerability.
This tool decodes any JWT without a key and verifies signatures only if you provide one. Decoding happens server-side and tokens are not stored for anonymous users, but as a habit, debug with expired or test-environment tokens rather than live production credentials.
Examples
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.(signature)
Output: header: {"alg": "HS256", "typ": "JWT"}Input: (same token)
Output: payload: {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}, iat = 2018-01-18 01:30:22 UTCFrequently asked questions
Is it safe to paste a JWT into an online decoder?
Be deliberate about it. On Velona, decoding happens server-side and nothing is stored for anonymous users, but a live production token is a bearer credential, and pasting it anywhere outside your own infrastructure widens its exposure. Use expired tokens or ones from a test environment when you can, and rotate any production token you have pasted into any third-party site.
Can I decode a JWT without the secret key?
Yes, the header and payload are just Base64URL-encoded JSON, readable by anyone. The key is only needed to verify the signature, i.e. to prove the token is genuine and untampered.
Why is my valid-looking token rejected by my server?
The usual suspects: the exp claim has passed, server clock skew makes iat/nbf appear to be in the future, the aud or iss claim doesn't match what the server validates, or the token was signed with a different key or algorithm than the server expects.
What's the difference between HS256 and RS256?
HS256 uses one shared secret for both signing and verifying, anyone who can verify can also forge. RS256 signs with a private key and verifies with a public one, so downstream services can validate tokens without gaining the power to mint them.
Does decoding a JWT verify that it's authentic?
No. Decoding only reads the claims. A forged token decodes just as cleanly as a real one, authenticity requires checking the signature against the issuer's key, which this tool does only when you supply that key.
Related tools
Velona is India's INR-native AI API gateway with 300+ models, UPI top-up from ₹10, no foreign card needed. These tools are free forever.