← Back to Toolbox

JWT Token Decoder

Instantly decode JSON Web Tokens (JWT), inspect headers/claims, and visualize expiration countdowns.

Decoded JOSE Header

              

              

                
Decoded Payload (Claims)

                

              

              
            


            

              
            

          


          

            
Tool Documentation & Usage Guide

            

              

                
What Is a JWT Token and How Does It Work?

                
JSON Web Token (JWT) is an open standard defined in RFC 7519 that provides a compact, URL-safe means of representing claims to be transferred between two parties. A JWT is digitally signed — using either a symmetric algorithm (HMAC SHA-256) or an asymmetric algorithm (RSA or ECDSA) — which allows the receiving party to verify its authenticity without contacting an authorization server. JWTs are now the backbone of modern authentication systems, used by OAuth 2.0, OpenID Connect, and countless REST API frameworks including Firebase, Auth0, AWS Cognito, and Supabase.

                
A JWT consists of three Base64URL-encoded sections joined by dots: the Header, the Payload, and the Signature. The Header declares the signing algorithm and token type. The Payload carries the claims — structured assertions about an entity such as a user ID, issued-at timestamp, expiry time, and custom roles. The Signature is generated by hashing the encoded Header and Payload together with a secret key, making any tampering immediately detectable.


                
How to Decode a JWT Using This Tool

                
Paste any JWT string (in the format xxxxx.yyyyy.zzzzz) into the input field. The tool instantly splits the token at its dot separators, Base64URL-decodes each segment, and displays the parsed JSON for the Header and Payload side by side. The expiry claim (exp) is automatically converted from a Unix timestamp to a human-readable countdown, so you can immediately tell whether the token is still valid or has expired. Click Clear Input to reset the form.


                
Is It Safe to Paste My JWT Token Online?

                
Yes — with this tool it is completely safe. Plobi-kit's JWT Decoder operates 100% inside your browser using client-side JavaScript. Your token string is never sent to any server, logged, or cached anywhere outside your local browser tab. This is critically important because JWTs often contain sensitive identity claims (user IDs, email addresses, roles, and custom permissions). Unlike many online decoders that process tokens server-side, this tool works entirely offline after the page has loaded.


                
Common Use Cases for JWT Decoding

                
    
                  
  • Debugging Authentication Flows: When an API request returns a 401 Unauthorized response, inspect your bearer token's claims (sub, aud, scope) to identify whether the wrong token is being sent or the correct claims are missing.
    • 
                  
  • Verifying Token Expiry: Check the exp (expiration) and iat (issued-at) claims to confirm whether a cached token is still valid before making a new authentication request.
    • 
                  
  • Inspecting Third-Party SSO Tokens: When integrating with Google Sign-In, GitHub OAuth, or enterprise SAML providers, decode the returned ID token to confirm which user attributes are included in the payload before implementing your user profile logic.
    • 
                


                
Frequently Asked Questions


Q: Is decoding a JWT the same as verifying it?
A: No. Decoding simply base64url-reads the payload so you can inspect it. Verification checks the signature with the secret or public key, which this tool cannot do without that secret.


Q: What is the difference between JWS and JWE?
A: JWS is signed, which guarantees integrity but leaves the payload readable. JWE is encrypted, which keeps the payload confidential. Most application tokens are JWS.


Q: What do common claims like exp, iat and sub mean?
A: Exp is the expiry time in seconds since the epoch, iat is when the token was issued, sub is the subject such as a user id, and aud or iss identify the audience and issuer.


Q: Should I put secrets inside the JWT payload?
A: Never. The payload is only base64url-encoded, not encrypted, so anyone who sees the token can read it. Store only non-sensitive claims there.


Q: Is my token uploaded when I decode it?
A: No. Decoding happens locally in your browser. Still, never paste a real secret or refresh token into any site you do not fully trust.


How This Tool Works


This JWT Token Decoder runs entirely in your web browser through Plobi-kit's 100% client-side architecture. No input is sent to external web servers, guaranteeing complete privacy and offline utility. Want proof? Open your browser's Network tab, use the tool, and watch: nothing leaves your machine except the page's own assets.