Online JWT Decoder and Token Debugger

Decode and inspect JSON Web Tokens by separating the header, payload and signature. The viewer helps diagnose authentication claims, expiration timestamps, signing algorithms and token content used by OAuth 2.0 and OpenID Connect systems.

A decoded JWT is not automatically trustworthy. Signature verification with the correct public key or certificate is required before relying on its claims.

Instructions

How to decode a JWT

To decode a JWT, paste the code into the JWT field. The tool automatically validates and reads it. The signature is copied into the signature field without decoding because it uses a dynamic process that differs from regular Base64 decoding.

A Bit About JWT and Its Variants

JWT, which stands for JSON Web Token, is an open standard (RFC 7519) that defines a compact and self-contained method for securely transmitting information between parties as a JSON object. JWT dates back to 2010, when distributed environments needed a more efficient and secure way to transmit identity information. The standard was developed by the IETF OAuth working group, led by Michael B. Jones and Nat Sakimura.

JWT is usually used for authentication and secure information exchange between different systems. It is made of three parts: the header, the payload and the signature. The header usually contains information about the token type and the cryptographic algorithm used, the payload contains the data to transmit, and the signature is used to verify whether the data was changed during transmission.

There are some JWT variations that are often used in different contexts

JWK (JSON Web Key): A public key format commonly used with JWT so the receiver can verify the token signature.

JWS (JSON Web Signature): A format for signing JSON content. It is used to sign JWTs, ensuring they were not changed during transmission.

JWE (JSON Web Encryption): Used when the JWT payload must be encrypted to ensure data confidentiality.

JWKS (JSON Web Key Set): A set of public keys used to verify JWT signatures. It is especially useful when validating tokens from different issuers.

Its simplicity and ability to represent data in a structured and readable way make JSON a common choice for many applications. A JSON object consists of key/value pairs, where keys are strings and values can be strings, numbers, booleans, arrays, objects or null. This makes it extremely flexible for representing many kinds of data.