JWT decoder · Guide
How to Decode a JWT Online
Decoding a JWT is quick once you know what to look at. Here is the process and the claims worth checking.
Paste the token
Copy the full token — all three dot-separated parts — and paste it in. The decoder immediately shows the header and payload as formatted JSON.
Read the header
The header names the signing algorithm (alg) and token type (typ). If alg is "none", treat the token with suspicion — unsigned tokens should not be trusted.
Check the payload claims
Look at exp (expiry), iat (issued-at), iss (issuer) and aud (audience), plus any custom claims your app relies on. An expired or wrong-audience token explains most auth failures.
Frequently asked questions
Can I use this for production work?
Yes, for inspection, formatting and quick generation. Still review the output before committing it to production code or configuration.
Ready to try it?
Open the free browser-based JWT decoder and apply what you just read — no sign-up, runs locally.
Open the JWT decoder tool