What is this tool?
The JWT Decoder reads the visible parts of a JSON Web Token: the header and payload. It also helps explain common timing claims such as iat, exp, and nbf.
Decoding is helpful for debugging authentication, but it is not the same as verifying a token signature. A decoded token can still be fake, expired, or invalid.
Why use this tool?
- It helps developers inspect token payloads during login and API debugging.
- It makes expiry and issued-at values easier to understand.
- It clearly separates decoding from signature verification.
- It is useful for frontend, backend, and QA teams checking auth flows.
- It helps spot wrong roles, tenants, subjects, or token times.
How to use it
- 1
Open the JWT Decoder.
- 2
Paste the full token into the JWT input field.
- 3
Click Decode to read the header and payload.
- 4
Review claims such as sub, role, exp, iat, nbf, issuer, and audience.
- 5
Check the warning that the signature is not verified by this decoder.
- 6
Fix the related auth configuration or token source based on what you find.
Common use cases
- A NestJS developer checks whether a guard receives the expected role claim.
- A Laravel API tester confirms whether a token expired before a request.
- A frontend developer checks whether the user ID in local storage matches the active account.
- A QA engineer compares staging and production issuer values.
- A support engineer inspects a token timing issue without exposing the signing secret.
Tips and best practices
- Never paste production secrets or signing keys into any decoder.
- Remember that decoding does not prove the token is trusted.
- Check token expiry in the same timezone context as your server logs.
- Use backend verification for real security decisions.
- Mask sensitive claim values before sharing screenshots.
FAQ
Does decoding a JWT verify it?
No. Decoding only reads the token content. Signature verification must happen with the correct secret or public key on the backend.
Can I check if a token is expired?
Yes. If the token has an exp claim, the decoder can help you understand the expiry time.
Is it safe to paste a JWT?
Be careful. A JWT can contain sensitive claims or grant access if still valid. Avoid sharing production tokens.
What are header and payload?
The header describes token metadata such as algorithm. The payload contains claims such as subject, roles, and timing.
Can this fix login issues?
It helps diagnose token content, but the actual fix may be in auth config, backend signing, guards, or frontend storage.