Décodeur JWT

Decode JSON Web Tokens and inspect header, payload, and signature

JWT Token

Jump to the next useful tool without leaving your flow.

See more

À propos de cet outil

A JWT is three Base64url-encoded segments joined by dots: a header saying which algorithm signed it, a payload carrying the claims, and a signature. The property that surprises people most is that the payload is not encrypted. It is merely encoded, which means anyone holding the token can read every claim inside it without a key, a password or this tool - decoding is a two-line operation in any language. That is by design: JWTs are meant to be readable by the client and verifiable by the server. What the signature protects is integrity, not secrecy. Change a single character of the payload and the signature no longer matches, so the server rejects it. This distinction has a practical consequence worth stating plainly: never put anything confidential in a JWT payload, because it is effectively public to whoever holds the token. Decoding here happens entirely in your browser.

Comment utiliser cet outil

  1. Paste the tokenPaste the full JWT including both dots. The three segments are split and decoded automatically.
  2. Read the headerIt names the signing algorithm - HS256, RS256 and so on - and the token type. This is the first thing to check when verification is failing.
  3. Read the payload claimsThe claims are shown as formatted JSON. Look for exp (expiry), iat (issued at), iss (issuer), aud (audience) and sub (subject).
  4. Check the expiryexp and iat are Unix timestamps in seconds. An expired token is the single most common cause of a 401 that "worked yesterday".

Pourquoi l’utiliser

  • Shows exactly what a token claims, which turns guesswork into a two-second check when debugging auth.
  • Formats the payload as readable JSON rather than a wall of encoded characters.
  • Handles Base64url correctly, so tokens decode where a plain Base64 decoder fails.
  • Runs in your browser - the token is never transmitted to a server.
  • No account and no rate limit.

Usages courants

  • Debugging a 401 by checking whether the token has actually expired.
  • Confirming that a login flow issues the roles, scopes or permissions you expect.
  • Checking the audience and issuer claims when a token is rejected by an API.
  • Inspecting a token from a third-party identity provider to see what it contains.
  • Learning how JWTs are structured while implementing authentication.

Conseils pour de meilleurs résultats

  • Check exp first. Timestamps are Unix seconds, not milliseconds - a value like 1767225600 is seconds; JavaScript's Date.now() gives milliseconds.
  • A mismatch between the aud claim and what the API expects is the second most common rejection after expiry.
  • The alg in the header tells you what the server must verify with. If it says "none", treat the token as untrusted.
  • Use an expired or test token when you are only exploring structure - habit matters more than any single tool being safe.
  • To create signed tokens for testing rather than read them, use the JWT Encoder.

Erreurs à éviter

  • Assuming the payload is private. It is readable by anyone holding the token, so personal data and secrets do not belong in it.
  • Treating a successful decode as proof the token is valid. Decoding ignores the signature entirely.
  • Storing JWTs in localStorage where any XSS can read them. An httpOnly cookie is the safer default.
  • Reading exp as milliseconds and concluding a valid token has expired, or the reverse.
  • Pasting a live production token that grants real access into any third-party site out of habit.

Formats pris en charge

  • JWT

Options disponibles

  • Decode header
  • Decode payload

Questions fréquentes

Paste the token above. The header and payload are decoded and shown as formatted JSON immediately - no key is needed, because those segments are only encoded.

Yes. No account, no limit, and the token never leaves your browser.

No. Decoding reads the header and payload; it does not check the signature. A decoded token tells you what it claims, not whether it is genuine or unmodified - only the server holding the signing key can determine that.

No. It is Base64url-encoded, which is reversible by anyone. The signature protects against tampering, not against reading, so never put confidential data in a payload.

Header (signing algorithm and token type), payload (the claims), and signature (proves the first two have not been altered). They are separated by dots and each is Base64url-encoded.

Look at the exp claim, a Unix timestamp in seconds. Compare it against the current time in seconds - if exp is smaller, the token has expired, which is the usual cause of a sudden 401.

Decoding happens locally and nothing is transmitted. Even so, avoid pasting production tokens that grant real access into any third-party tool as a matter of habit - use an expired or test token when you are just inspecting structure.

iss is the issuer, sub the subject (usually a user id), aud the intended audience, exp the expiry, iat when it was issued and nbf the earliest time it is valid. Anything else is a custom claim added by the issuing system.

Les gens recherchent aussi

  • jwt decoder online
  • decode jwt token free
  • jwt debugger
  • is jwt payload encrypted
  • check jwt expiry
  • jwt vs session token
  • json web token explained

Useful in

Related guides