apexapps.in
Tools›Encoders›JWT Decoder

JWT Decoder

Free online JWT token decoder and debugger. Instantly decode and inspect JWT header, payload and signature. No data sent to any server — 100% client-side.

Paste JWT Token

100% Client-Side Decoding

All decoding happens in your browser. Your JWT is never sent to our servers. You can verify this by opening Browser DevTools → Network tab — you'll see zero outgoing requests while using this tool.

Paste+tokenAuto-decode
Click+sectionCopy JSON

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe token format used for securely transmitting information between parties. JWTs are widely used for authentication, authorization, and information exchange in modern web applications.

JWT Structure

A JWT consists of three Base64URL-encoded parts separated by dots:

  1. Header — Contains the token type (JWT) and the signing algorithm (e.g., HS256, RS256).
  2. Payload — Contains claims: statements about the user and additional metadata. Standard claims include sub (subject), iat (issued at), and exp (expiration).
  3. Signature — Created by signing the header and payload with a secret key. Used to verify the token hasn't been tampered with.

Important Security Note

JWTs are encoded, not encrypted. Anyone can decode the header and payload — the signature only proves the token hasn't been modified. Never put secrets (passwords, API keys) in a JWT payload.

Secure JSON Web Token (JWT) Analyzer

JSON Web Tokens (JWT) are the undisputed backbone of modern API authentication. But when an endpoint throws a cryptic "401 Unauthorized" error, debugging the token can be a nightmare. You need a way to tear down the token to inspect its expiration claims, issuer signatures, and custom payload data. Our JWT Decoder unpacks all three segments of the token intuitively and instantly.

However, security is paramount. Standard online JWT decoders often transmit your literal production access tokens to cloud servers for parsing—an egregious security violation. Our analyzer guarantees profound privacy by reverse-engineering the token 100% client-side. The Base64url parsing, the JSON formatting, and even the cryptographic signature verification all execute exclusively in your browser's local memory. You can safely debug high-privilege administrative tokens without violating compliance regulations.

Breaking Down a JWT

  1. 1

    Submit the token string

    Paste the full, raw JWT (which looks like three long strings of random characters separated by two periods) into the input box.

  2. 2

    Analyze the header

    Look at the parsed Header tab. This will immediately tell you the cryptographic algorithm used to sign the token (e.g., HS256, RS256) and the token type.

  3. 3

    Inspect the payload

    The Payload tab reveals the actual data. Here you can check standard claims like the subject ID (`sub`), issued-at time (`iat`), or any custom roles the authorization server attached to the user.

  4. 4

    Verify expiration

    The tool intercepts the `exp` claim and cross-references it against your system clock, explicitly telling you if the token is currently valid or how long ago it expired.

Crucial JWT Debugging Cases

Diagnosing Authentication Failures

When your frontend framework receives an access denied error from the backend, decoding the token here instantly reveals if the token is simply expired or if it's missing a required OAuth scope claim.

Verifying OpenID Connect Data

Integrating "Login with Google" or Auth0? Those ID tokens are just JWTs. Paste them in to verify that the provider is successfully sending over the user's email, profile picture URL, and verified status.

Auditing Security Implementations

If your JWT header shows the algorithm as "none", your API has a critical vulnerability that allows attackers to bypass signature verification entirely. Checking tokens here helps catch misconfigurations before they reach production.

apexapps.in vs jwt.io vs token.dev

Featureapexapps.injwt.iotoken.dev
Absolute zero-server transmission guarantee❌ (telemetry)
No registration walls
Automatic timestamp-to-relative-time conversion
Cryptographic signature verification built-in
Works offline in airplane mode

Understanding Token Architecture

Can anyone read the information inside a JWT?

Yes. This is the most crucial concept regarding JWTs: the payload is merely encoded in Base64url, it is not encrypted. Unless you are specifically utilizing JWE (JSON Web Encryption), any user, script, or intercepted network packet can read the payload data easily.

If anyone can read a JWT, how is it secure?

A JWT ensures data integrity, not data privacy. The final segment of the token is a cryptographic signature generated by the server. If a malicious user decodes the token, changes their `role` from "user" to "admin", and re-encodes it, the cryptographic signature will fail validation on the server.

What is the difference between an HS256 and RS256 token?

HS256 is an HMAC algorithm that uses one symmetrical secret key to both sign the token on the auth server and verify it on the API server. RS256 uses a public/private key pair (RSA)—the auth server signs the token with a deeply guarded private key, and any API service can verify it using a freely distributed public key.

What does the "exp" claim value mean?

The `exp` claim dictates the precise moment the token becomes invalid. It is formatted as a Unix Epoch timestamp (the number of elapsed seconds since January 1st, 1970). Our tool automatically translates that integer into a human-readable date and time.

Keep Building with Related Tools

Because JWTs are built upon other web standards, you may need these tools to manually inspect token fragments or JSON configurations.

Base64 Encoder→JSON Formatter→Timestamp Converter→