•10 min read
How to Decode JWT Tokens: A Complete Guide
Learn how to decode and validate JWT tokens. Understand JWT structure, security best practices, and common use cases.
JWT Decoder
Decode JWT tokens locally to inspect header + payload claims (exp/nbf/iat, iss/aud, scopes/roles) and debug OAuth2/OIDC authentication issues.
JWT Token
Input
Decoded JWT
Output
What is JWT Decoder?
JWT Decoder & Claims Inspector is a developer tool for decoding JSON Web Tokens (JWT/JWS) used in OAuth2, OpenID Connect (OIDC), SSO, and API authentication. Paste a token and instantly view the decoded header and payload as readable JSON, including important claims like exp (expiration), nbf (not before), iat (issued at), iss (issuer), aud (audience), sub (subject), jti (token id), scope/scp, roles, permissions, and custom app claims. This is ideal for debugging 401/403 errors, validating that your identity provider (Auth0/Okta/Cognito/Keycloak/etc.) is issuing the expected claims, and catching risky headers such as unexpected alg values. Decoding happens locally with Base64URL parsing—no network calls, no storage, and no token logging.
How to Use
1
Copy the full token from your Authorization header (Bearer …), cookie, localStorage, or API response
2
Paste the JWT into the input field (format: header.payload.signature)
3
Click "Decode JWT" (or decode automatically) to view header + payload as JSON
4
Check exp/nbf/iat to confirm the token is currently valid (clock skew can matter)
5
Verify iss (issuer) and aud (audience) match what your backend expects
6
Inspect scope/scp/roles/permissions claims to understand authorization decisions
7
Confirm typ/kid/alg in the header to ensure your verification settings match
8
Copy decoded JSON when debugging (avoid sharing real production tokens publicly)
Common Use Cases
Fix 401 Unauthorized: Confirm exp is not expired and nbf is not in the future
Fix 403 Forbidden: Inspect scopes/roles/permissions claims vs your RBAC rules
Debug OAuth2/OIDC issues: Verify iss/aud, client_id/azp, nonce, and identity claims
Troubleshoot API gateways: Compare claims at the edge vs downstream services
Validate SSO integrations: Ensure your IdP includes the claims your app requires
Check token type: Distinguish access tokens vs ID tokens by typical claim patterns
Detect suspicious headers: Spot alg=none, unexpected typ, missing kid, or weird structures
Explain auth bugs in PRs/tickets: Copy readable claim JSON instead of raw tokens
Key Features
Instant Base64URL decoding of JWT header + payload
Readable JSON output (great for debugging and documentation)
Highlights validation-critical claims
exp, nbf, iat, iss, aud, sub, jti
Works for OAuth2 access tokens and OIDC ID tokens (claim inspection)
Helps triage 401 vs 403 quickly by inspecting validity vs permissions
Local-only processing
no network calls, no uploads, privacy-first
Copy-friendly output for bug reports (sanitize sensitive claims first)
Handles common real-world claim shapes
scope/scp arrays/strings, roles, permissions
Related Articles
Learn more about this tool with our in-depth guides