What's inside this JWT token? How do I decode it?
Paste a JWT token, the tool shows the header, payload, and signature. Everything runs in your browser, the token never leaves your device.
This matters because the well-known jwt.io sends tokens over the wire. Pasting a production token there = an invitation to trouble. Here everything is local.
Perfect for debugging authorization: access tokens, refresh tokens, ID tokens from Auth0, Cognito, Firebase, Keycloak.
How to use it
- Copy your JWT token (starts with "eyJ..." and has 3 dot-separated sections).
- Paste into the text field, parses automatically (no clicking).
- On the right you see the header (algorithm + type), on the left the payload (claims: sub, iss, exp, custom claims), the signature below.
- Pills at the top show: algorithm (HS256/RS256/...), type (JWT/JWE), issue date (iat), expiration (exp). Expired token = exp pill turns red.
When this is useful
Seven typical situations where a JWT decoder helps you understand what is actually inside the token:
- Authorization debugging. You get a token from the backend, want to see the claims (role, organization, scopes).
- Auth0 / Cognito / Firebase / Keycloak. Decoding the ID token reveals all user attributes.
- Expiry check. Is the refresh token still valid? The exp pill answers.
- Code review. A colleague pasted a token in chat, you want to see what's inside before reporting an incident.
- Education. See how JWT actually works for people learning authorization.
- OAuth 2.0 / OpenID Connect. Parsing Bearer access tokens.
- Audit. Exp too long? Wrong scopes? SHA-1 signature?
Questions and answers
No. Verifying HS256 needs the secret key, RS256 needs the public key. The decoder shows only the structure. To verify or sign tokens in the browser, use our JWT signer / verifier. If you need an RSA / EC keypair for signing, generate one with the JWT keypair generator.