What is a JWT Decoder?
A JWT decoder is an online tool that reads a JSON Web Token and shows its header, payload, and signature segment. It helps developers inspect auth tokens, debug API issues, and understand claims like exp and sub without setting up backend tooling.
What this tool does
- Decodes JWT header and payload as formatted JSON.
- Validates basic JWT structure (header.payload.signature).
- Shows common claims in a readable table.
- Converts exp, iat, and nbf timestamps into human-readable dates.
- Displays token status: Active, Expired, Not active yet, or No expiry.
- Highlights algorithm details and security warnings.
How to decode a JWT online
- Paste your JWT into the input panel.
- Click Decode.
- Review header JSON, payload JSON, claims, and expiry status.
- Copy payload, header, or full decoded JSON as needed.
Understanding JWT header, payload, and signature
A JWT has three dot-separated parts. The header usually contains alg and typ. The payload contains claims such as user id, roles, and expiry. The signature is used by servers to verify trust — this tool shows whether the signature segment exists but does not verify it in V1.
Common JWT claims explained
| Claim | Meaning |
|---|---|
| iss | Issuer — who created the token |
| sub | Subject — usually the user id |
| aud | Audience — intended recipient service |
| exp | Expiration — unix timestamp when token expires |
| iat | Issued at — unix timestamp when token was created |
| nbf | Not before — token is invalid before this time |
| role / roles | Permission or role claims when present |
| scope | OAuth-style API permission scopes |
How JWT expiration works
The exp claim stores a Unix timestamp for when the token should stop being accepted. The nbf claim means the token is not valid before that time. AceDevHub shows both raw timestamps and readable dates so you can quickly see whether a token is active or expired.
JWT decoding vs JWT verification
Decoding only reads the token contents. Verification checks the signature with a secret or public key and confirms the token was issued by a trusted authority. This V1 tool decodes for inspection only. Do not treat a decoded payload as proof that a token is trustworthy.
Common JWT mistakes
- Confusing decoding with verification
- Trusting a decoded payload without checking the signature
- Using tokens after exp has passed
- Forgetting nbf means "not before"
- Storing sensitive secrets inside JWT payload
- Using alg: none
- Using very long token expiry
- Putting too much user data inside tokens
- Assuming JWT payload is encrypted
FAQ
- Does this JWT decoder verify signatures?
- No. V1 decodes and inspects JWT structure and claims only. It does not verify HS256, RS256, or any other signature.
- Is my JWT sent to a server?
- No. Tokens are decoded locally in your browser. Do not paste production secrets or sensitive user tokens.
- What is the difference between decoding and verifying a JWT?
- Decoding reads the header and payload. Verifying checks that the signature was created by a trusted key. This tool decodes only.
- Why does my token show as expired?
- If the exp claim is in the past, the tool marks the token as expired. That does not mean the payload is fake — only that the expiry time has passed.
- What does alg: none mean?
- It means no signature algorithm was used. Tokens with alg "none" should not be trusted in production systems.
- Can I use this for Auth0, Clerk, or Firebase tokens?
- You can inspect the header and payload structure, but this tool does not integrate with provider-specific verification flows in V1.
- Is JWT payload encrypted?
- No. JWT payloads are base64url-encoded JSON, not encrypted. Anyone who has the token can decode the payload.
Related tools
Related interview prep
- JavaScript Interview Questions — Auth basics and API security often appear in JavaScript interviews.
- Node.js Interview Questions — JWT, sessions, and middleware are common Node.js backend topics.
- Full Stack Developer Interview Questions — Full-stack roles expect JWT literacy across frontend and backend.
Related roadmaps
- JavaScript Roadmap — Build JavaScript fundamentals before diving into auth-heavy backend work.
- Node.js Backend Developer Roadmap — Backend developers implement JWT issuance, validation, and expiry policies.
- Full Stack Developer Roadmap — Structured path from JavaScript basics to production auth workflows.
Want the full structured path from JavaScript basics to production auth and API workflows? Join the AceDevHub course waitlist.
Join the course waitlist