JWT Decoder: Complete Guide to Decoding JSON Web Tokens

If you’ve worked with modern web applications, you’ve encountered JWTs. Those seemingly random strings of characters appear in authorization headers, API responses, and authentication flows everywhere. But what do they actually contain? How do you verify them? Understanding JWTs isn’t optional anymore—it’s essential for building secure applications.

This guide walks you through everything you need to know about decoding and understanding JSON Web Tokens.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. Think of it as a digital credential—information about a user or entity that’s been signed so recipients can verify its authenticity.

JWTs are predominantly used for:

Authentication: Verifying user identity after login
Authorization: Determining what resources a user can access
Information Exchange: Securely transmitting claims between services

JWT Structure Explained

A JWT consists of three parts, separated by dots:

code

xxxxx.yyyyy.zzzzz

Each part is Base64URL-encoded.

The Header

The header typically contains two parts: the token type (JWT) and the signing algorithm used:

json

{
  "alg": "HS256",
  "typ": "JWT"
}

Common algorithms include HS256 (HMAC with SHA-256), RS256 (RSA Signature with SHA-256), and ES256 (ECDSA with SHA-256).

The Payload

The payload contains the claims—statements about the entity (typically the user) and additional metadata:

json

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022,
  "exp": 1516242622
}

Reserved claims like iss (issuer), sub (subject), aud (audience), exp (expiration), and iat (issued at) have standardized meanings.

The Signature

The signature is created by combining the encoded header, encoded payload, and a secret or private key, then signing with the specified algorithm. This ensures the token hasn’t been tampered with.

Using Our JWT Decoder

Our free JWT decoder makes it effortless to inspect tokens:

Decoding a Token

Paste your JWT into the input field
The tool automatically decodes all three sections
View the header, payload, and signature separately
Inspect claims in human-readable format

Understanding Expiration

JWTs often include an exp claim—the expiration timestamp. Our decoder shows this as a readable date:

Green: Token is valid (not expired)
Red: Token has expired

Verifying Token Claims

Check important claims at a glance:

iss: Who issued the token
sub: Who the token is about
aud: Intended recipient
exp: When the token expires
iat: When the token was issued

Common JWT Use Cases

Single Sign-On (SSO)

JWTs enable seamless authentication across multiple applications. When you log into one service, it can issue a JWT that other services trust.

API Authorization

Modern APIs commonly use JWTs in the Authorization header:

code

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

The API verifies the signature and extracts user information from the payload without querying a database.

Mobile Authentication

Mobile apps frequently use JWTs because they’re compact and work well with intermittent network connections.

JWT Security Best Practices

Never Expose Sensitive Data

The payload is Base64-encoded, not encrypted. Anyone can decode it. Never put passwords, credit card numbers, or other sensitive information in a JWT.

Always Verify Signatures

Decoding a JWT doesn’t mean it’s valid. Always verify the signature using the same algorithm and secret/key the issuer used.

Set Appropriate Expiration

Long-lived tokens are risky. Set exp claims to a reasonable duration—typically minutes to hours, not days or weeks.

Use Strong Algorithms

Avoid none algorithm (no signature). Use RS256 or ES256 for asymmetric signing when possible.

JWT vs Other Token Formats

Session IDs

Traditional session IDs require server-side storage. JWTs are self-contained—they include all necessary information without database lookups.

Opaque Tokens

Opaque tokens are random strings that require validation against a server. JWTs can be validated client-side, reducing server load.

SAML Tokens

SAML is XML-based and typically larger than JWTs. JWTs are easier to work with in modern JavaScript applications.

Troubleshooting Common JWT Issues

“Token expired” Error

The exp claim has passed. You’ll need to obtain a fresh token by re-authenticating.

Invalid Signature

The signature doesn’t match. Common causes:

Wrong secret key
Algorithm mismatch
Token was tampered with

“No ‘kid’ header” Warning

The kid (key ID) claim helps select the correct key for verification. It’s recommended for production systems using multiple keys.

FAQ

Can I decode a JWT without a secret?

Yes, you can decode and read the payload without the secret. However, you cannot verify the signature without it. Our decoder shows the decoded content but marks the signature as unverified.

How long is a JWT valid?

There’s no universal answer—it depends on your security requirements. Access tokens are typically short-lived (5-60 minutes), while refresh tokens may last days or weeks. Balance security with user experience.

Can JWTs be revoked?

JWTs are designed to be self-contained and typically don’t require server lookups. To revoke, implement a token blacklist (less efficient), use short expiration times, or use refresh token rotation.

What's the difference between HS256 and RS256?

HS256 uses a symmetric secret—both issuer and verifier share the same key. RS256 uses asymmetric keys—the issuer has a private key, and anyone with the public key can verify. RS256 is generally preferred for distributed systems.

Should I store JWTs in localStorage or cookies?

For web applications, HTTP-only cookies are generally more secure against XSS attacks. localStorage is vulnerable to XSS but works for cross-domain scenarios. Consider your threat model when deciding.

Key Takeaways

JWTs have three parts: header, payload, and signature—all Base64URL-encoded
The payload contains claims about the user but isn’t encrypted
Always verify signatures before trusting token data
Set appropriate expiration times—shorter is more secure
Never put sensitive data in the JWT payload

Our JWT decoder and JWT generator tools make working with JSON Web Tokens straightforward. Whether you’re debugging authentication issues or building secure applications, understanding JWTs is essential.

—

Sources

For related developer tools, check out our hash generator for creating secure checksums, JSON formatter for working with JSON data, and URL encoder for web encoding tasks. Our binary-hex-decimal converter is also useful for developers working with different number systems.