JWT Decoder & Debugger

JWT Example Payloads

Click any example below to load it into the decoder and see how different JWT tokens are structured. Each example demonstrates a specific use case or security scenario.

All example tokens are signed with HS256. Enter secret key toolmodoom in the Verify Signature section to test signature verification.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. JWTs are widely used for authentication and authorization in web applications, APIs, and microservices. When you log in to a website, the server often issues a JWT that your browser sends with every subsequent request to prove your identity.

Unlike traditional session-based authentication that requires server-side storage, JWTs are self-contained — all the information needed to verify the token is encoded within the token itself. This makes them ideal for stateless architectures and distributed systems.

JWT Structure (Header, Payload, Signature)

A JWT consists of three parts separated by dots (.):

1. Header — Contains the token type (typ: JWT) and the signing algorithm (alg: HS256, RS256, etc.).
2. Payload — Contains claims (statements about the user and metadata). Claims include registered claims like exp (expiration), iss (issuer), and sub (subject), plus any custom data.
3. Signature — Created by signing the encoded header and payload with a secret key (HS256) or a private key (RS256/ES256). The signature ensures the token hasn't been tampered with.

Each part is Base64URL-encoded, making the token URL-safe and compact enough to be sent in HTTP headers, cookies, or URL parameters.

JWT Algorithm Comparison

JWTs support multiple signing algorithms. Choosing the right one depends on your architecture, security requirements, and key management capabilities.

Recommendation: Use RS256 or ES256 for production systems. Use HS256 only when the signing and verification happen on the same server. Never use none in production.

Common JWT Claims

The JWT specification defines seven registered claims:

💡 Need to generate a unique jti value? Use the UUID Generator — UUID v4 (random) is the recommended choice for JWT IDs, providing collision-free uniqueness without leaking creation time.

Common Public Claims (OAuth2 / OpenID Connect)

In addition to registered claims, these public claims are widely used in OAuth2 and OIDC tokens:

JWT vs Session/Cookie

When building authentication, developers often choose between JWT-based and session-based approaches. Each has distinct trade-offs depending on your architecture:

Neither approach is universally better. JWTs excel in distributed, stateless architectures where multiple services need to verify identity without a central session store. Sessions are simpler and more secure for traditional server-rendered applications where immediate revocation matters.

Common JWT Errors and How to Fix Them

When working with JWTs, you may encounter these common error messages. Paste your token into the tool above to inspect the Header and Payload for debugging.

JWT Security Best Practices

• Always set an expiration time (exp) — tokens without expiration never become invalid.
• Never use alg: "none" — this disables signature verification, allowing anyone to forge tokens.
• Don't store sensitive data in the payload — JWTs are encoded, not encrypted. Anyone can decode the payload.
• Use strong signing algorithms — prefer RS256 or ES256 over HS256 for production systems.
• Keep token lifetimes short — use refresh tokens for long-lived sessions.
• Validate the iss and aud claims — ensure the token was issued by and intended for your application.

JWT in Different Frameworks

Here are the most popular JWT libraries for each programming language, along with their install commands:

All of these libraries support token creation, signing, verification, and claim validation. For decoding without verification (inspecting token contents), most also provide a decode method that skips signature checking — similar to what this tool does in your browser.

How to Use This Tool

1. Paste your JWT token into the input field above, or click Paste Sample to try a demo token.
2. The tool instantly decodes the Header and Payload with syntax highlighting.
3. Time-based claims (exp, iat, nbf) are automatically converted to human-readable dates in your selected timezone.
4. Security warnings appear if potential issues are detected (e.g., alg: none, missing expiration, sensitive data in claims).
5. Click → JSON Formatter to open the decoded payload in our JSON Formatter tool for further inspection.
6. Optionally, enter your secret key and click Verify Signature to check if the signature is valid.

Features

Privacy & Security

Your JWT token is processed entirely in your browser using JavaScript. Nothing is sent to any server. All decoding, claim analysis, security checks, and signature verification happen locally. You can verify this by opening your browser's developer tools and checking the Network tab — no requests are made with your token data. This tool is safe to use with production tokens and sensitive credentials.