JWT Decoder Online — Decode JWT Tokens Free - Keynou Blog

A JWT decoder online splits a JSON Web Token into its three components — header, payload, and signature — and decodes each part so you can inspect the claims, algorithm, and expiration without writing a script. Whether you're debugging an authentication flow, verifying token expiration, or checking which algorithm a service uses, a browser-based decoder gives you instant visibility into what's inside the token. This guide covers JWT structure, common claims, algorithm types, security considerations, and debugging workflows.

JWT Structure: Header.Payload.Signature

A JWT is a compact, URL-safe string consisting of three Base64-encoded parts separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiZXhwIjoxNzMyNzU4NDAwfQ.signature_here

Each part serves a specific purpose:

<svg viewBox="0 0 800 260" xmlns="http://www.w3.org/2000/svg" style="width:100%;max-width:800px;margin:24px auto;display:block">
  <rect x="0" y="0" width="800" height="260" fill="#f8fafc" rx="12"/>
  <text x="400" y="35" fill="#1e293b" font-size="17" font-family="sans-serif" text-anchor="middle" font-weight="bold">JWT Token Structure</text>
  <rect x="30" y="60" width="240" height="120" fill="#3b82f6" rx="8"/>
  <text x="150" y="90" fill="white" font-size="14" font-family="sans-serif" text-anchor="middle" font-weight="bold">Header</text>
  <text x="150" y="115" fill="#dbeafe" font-size="11" font-family="sans-serif" text-anchor="middle">Algorithm &amp; token type</text>
  <text x="150" y="140" fill="#dbeafe" font-size="10" font-family="monospace" text-anchor="middle">{"alg":"HS256","typ":"JWT"}</text>
  <text x="150" y="165" fill="#dbeafe" font-size="11" font-family="sans-serif" text-anchor="middle">Base64URL encoded</text>
  <text x="280" y="120" fill="#94a3b8" font-size="24" font-family="sans-serif" text-anchor="middle" font-weight="bold">.</text>
  <rect x="295" y="60" width="240" height="120" fill="#8b5cf6" rx="8"/>
  <text x="415" y="90" fill="white" font-size="14" font-family="sans-serif" text-anchor="middle" font-weight="bold">Payload</text>
  <text x="415" y="115" fill="#ede9fe" font-size="11" font-family="sans-serif" text-anchor="middle">Claims (user data)</text>
  <text x="415" y="140" fill="#ede9fe" font-size="10" font-family="monospace" text-anchor="middle">{"sub":"123","name":"Alice"}</text>
  <text x="415" y="165" fill="#ede9fe" font-size="11" font-family="sans-serif" text-anchor="middle">Base64URL encoded</text>
  <text x="545" y="120" fill="#94a3b8" font-size="24" font-family="sans-serif" text-anchor="middle" font-weight="bold">.</text>
  <rect x="560" y="60" width="210" height="120" fill="#f59e0b" rx="8"/>
  <text x="665" y="90" fill="white" font-size="14" font-family="sans-serif" text-anchor="middle" font-weight="bold">Signature</text>
  <text x="665" y="115" fill="#fef3c7" font-size="11" font-family="sans-serif" text-anchor="middle">HMAC or RSA signature</text>
  <text x="665" y="140" fill="#fef3c7" font-size="10" font-family="monospace" text-anchor="middle">HMAC-SHA256(...)</text>
  <text x="665" y="165" fill="#fef3c7" font-size="11" font-family="sans-serif" text-anchor="middle">Not decoded — verified</text>
  <text x="150" y="220" fill="#64748b" font-size="11" font-family="sans-serif" text-anchor="middle">Decoded to view</text>
  <text x="415" y="220" fill="#64748b" font-size="11" font-family="sans-serif" text-anchor="middle">Decoded to view</text>
  <text x="665" y="220" fill="#64748b" font-size="11" font-family="sans-serif" text-anchor="middle">Verified with secret/key</text>
</svg>

The JWT decoder splits the token at the dots, Base64URL-decodes the header and payload, and displays them as formatted JSON. The signature is not decoded — it's a cryptographic value that you verify, not read.

Common Claims

The payload contains claims — statements about the token and the user. Some claims are standardized in RFC 7519; others are custom.

Claim	Name	Description
`iss`	Issuer	Who issued the token
`sub`	Subject	Who the token is about (usually user ID)
`aud`	Audience	Intended recipient of the token
`exp`	Expiration	When the token expires (Unix timestamp)
`nbf`	Not Before	When the token becomes valid
`iat`	Issued At	When the token was created
`jti`	JWT ID	Unique identifier for the token

Custom claims are anything the issuer adds — name, email, role, permissions, etc. These vary by application.

Checking Expiration

The exp claim is a Unix timestamp. A good decoder converts it to a human-readable date and tells you whether the token is currently valid or expired. This is the most common debugging task — "why is my API returning 401?" is often an expired token.

Algorithm Types

The alg field in the header specifies how the signature was generated. Common algorithms:

Algorithm	Type	Key	Use Case
HS256	HMAC + SHA-256	Shared secret	Simple setups, single server
HS384	HMAC + SHA-384	Shared secret	Higher security HMAC
HS512	HMAC + SHA-512	Shared secret	Highest security HMAC
RS256	RSA + SHA-256	Public/private key pair	Distributed systems, microservices
RS384	RSA + SHA-384	Public/private key pair	Higher security RSA
ES256	ECDSA + SHA-256	Elliptic curve key pair	Performance-sensitive systems
ES512	ECDSA + SHA-512	Elliptic curve key pair	High security + performance

HMAC algorithms use a shared secret — both the issuer and verifier know the same key. RSA and ECDSA use asymmetric keys — the issuer signs with a private key, and verifiers check with a public key. Asymmetric algorithms are preferred when multiple services need to verify tokens without sharing the signing key.

Security Considerations

JWTs Are Not Encrypted

The header and payload are Base64-encoded, not encrypted. Anyone who intercepts the token can read its contents. The signature prevents tampering, not reading. If you need to hide the payload, use JWE (JSON Web Encryption) instead of standard JWT.

Never Put Secrets in the Payload

Because the payload is readable by anyone, never include passwords, API keys, or other sensitive data in JWT claims. Put only identifiers (user ID, roles) and let your backend fetch sensitive data using those identifiers.

The `alg: none` Vulnerability

Some older JWT implementations accepted alg: none in the header, meaning no signature was required. An attacker could change the algorithm to none and modify the payload freely. Modern libraries reject this, but it's worth checking your decoder flags it.

Verify the Signature

Decoding a JWT only reads the contents — it doesn't verify authenticity. To confirm a token was issued by the expected party and hasn't been modified, you must verify the signature using the secret (for HMAC) or public key (for RSA/ECDSA). The JWT decoder shows the signature and lets you verify it if you provide the secret or public key.

Debugging Use Cases

Authentication Failures

A user reports "I can't log in." Decode their JWT and check:

Is exp in the past? Token expired.
Is iss correct? Wrong issuer.
Is aud correct? Token issued for a different audience.

Token Inspection During Development

When building an auth flow, decode tokens at each stage to verify the right claims are being set. Check that sub matches the user ID, role claims are correct, and expiration is set to the expected duration.

Comparing Tokens

Decode two tokens side by side to see what differs — useful when one token works and another doesn't, and you need to spot the difference in claims.

Verifying Token Refresh

After a token refresh, decode both the old and new tokens to confirm the new one has an updated exp and the same sub.

Tips for Working with JWTs

Always check exp — expired tokens are the #1 cause of auth failures
Use short expiration times — access tokens should expire in minutes, not hours; use refresh tokens for longer sessions
Verify signatures in production — decoding is for debugging; your backend must verify signatures
Don't store sensitive data in payloads — the payload is readable by anyone with the token
Use the Base64 decoder for manual inspection — JWT parts are Base64URL-encoded; you can decode them manually if needed

JWT Decoder — Decode and inspect JWT tokens
Base64 Converter — Decode Base64URL manually
Hash Generator — Generate hashes for comparison and verification

Published: August 20, 2026
Category: Data Tools
Reading Time: 5 minutes

Blog

JWT Decoder Online — Decode JWT Tokens Free

JWT Structure: Header.Payload.Signature