Decode and inspect JWT (JSON Web Token) tokens. View the header, payload, and signature components of JWTs for debugging authentication and API authorization.
JWT (JSON Web Token) is a standard for securely transmitting information between parties as a JSON object. A JWT consists of three parts separated by dots: Header (algorithm & type), Payload (claims/data), and Signature (verification). Decoding a JWT lets you inspect its contents for debugging authentication flows and API authorization issues.
JWT = Header.Payload.Signature (each part is Base64Url encoded)The Header contains the token type and signing algorithm. The Payload contains claims (registered, public, and private) — data like user ID, roles, and expiration. The Signature is computed from the header and payload using the specified algorithm and a secret key. Only the Header and Payload can be decoded without the secret.
| Input | Output |
|---|---|
| eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c | Header: {"alg":"HS256","typ":"JWT"} Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022} |
| eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOjEsInJvbGUiOiJhZG1pbiJ9.abc123 | Header: {"typ":"JWT","alg":"HS256"} Payload: {"userId":1,"role":"admin"} |
| invalid-token | ✗ Invalid JWT format — Expected 3 parts separated by dots |