About this tool
What is a JWT?
A JSON Web Token is a compact, URL-safe token with three Base64url parts — header, payload, signature — separated by dots. Servers issue them at login; clients present them with each request instead of re-authenticating. The payload is readable by anyone, so it must never carry secrets.
How to use it
- Paste a token to decode its header and claims with syntax highlighting.
- Inspect expiry (
exp), issuer (iss) and audience (aud). - Verify the signature when you hold the secret or public key.
Examples
- Debugging “401 Unauthorized”: is the token expired or scoped wrong?
- Confirming which user and roles a staging token actually carries.
- Checking that a refreshed token kept the same claims.
Important limitations
- decoding ≠ verifying: anyone can read a JWT; only signature verification proves it is genuine.
- Tokens cannot be revoked by themselves — short lifetimes plus refresh rotation handle logout.
- Storing tokens in localStorage exposes them to XSS; httpOnly cookies with CSRF protection are safer for sessions.
Privacy
Decoding is fully local — critical, because pasted tokens often grant real access. Never paste a production token into any online tool you do not fully trust, including this one: prefer a local run for secrets.
Frequently asked questions
Why does decoding work without my secret?
The payload is only Base64url-encoded, not encrypted. The secret is needed to verify, not to read.
How long should tokens live?
Access tokens: minutes. Long-lived sessions belong in rotating refresh tokens, not in the JWT itself.
JWT vs opaque session tokens?
JWTs shine for stateless, cross-service auth. Opaque tokens win when instant server-side revocation matters.