JWT Decoder Online — Decode & Inspect JSON Web Tokens

Decode, inspect, and understand JSON Web Tokens without installing anything.

What Is a JWT?

A JSON Web Token (JWT) is the most common token format for web authentication in 2026. When you log into a modern web app, chances are a JWT is being passed between your browser and the server to prove your identity.

A JWT looks like this:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Those three sections separated by dots are:

1. Header — Algorithm and token type (e.g., HS256, JWT)
2. Payload — Claims (data): user ID, expiration time, roles, etc.
3. Signature — Verification that the token hasn't been tampered with

How to Decode a JWT

Each section is simply Base64URL encoded. To decode manually:

// JavaScript
const [header, payload, signature] = jwt.split('.');
const decodedHeader = JSON.parse(atob(header));
const decodedPayload = JSON.parse(atob(payload));
console.log(decodedHeader);  // {"alg": "HS256", "typ": "JWT"}
console.log(decodedPayload); // {"sub": "1234567890", "name": "John Doe", ...}

Common JWT Claims

• sub (Subject) — Who the token is about (usually user ID)
• iss (Issuer) — Who created the token (your auth server)
• exp (Expiration) — Unix timestamp when the token expires
• iat (Issued At) — Unix timestamp when the token was created
• aud (Audience) — Who the token is intended for
• nbf (Not Before) — Token is not valid before this timestamp
• jti (JWT ID) — Unique identifier for the token

JWT Security Best Practices

• Never store sensitive data in the payload — JWTs are readable by anyone (they're just Base64)
• Always verify signatures server-side — Don't trust a JWT without checking its signature
• Use short expiration times — 15-60 minutes for access tokens, longer for refresh tokens
• Use HTTPS only — JWTs in transit can be intercepted on unencrypted connections
• Prefer RS256 over HS256 for production — asymmetric keys are more secure for distributed systems

JWT vs Session Tokens

Traditional session tokens are random strings stored in a server-side database. JWTs are self-contained — the server doesn't need to look anything up. This makes JWTs ideal for:

• Microservices — Each service can verify the token independently
• Stateless APIs — No session storage needed on the server
• Cross-domain authentication — Single sign-on across multiple services

The tradeoff: JWTs can't be revoked individually (without a blocklist), and they're larger than simple session IDs.