JWT Dev Tools jwtdevtools.com
100% in browser No signup

JWT Decoder & Toolkit

Decode · Generate · Verify · Diff · Audit · Share — all in your browser.

⌘↵ Decode ⌘K Clear ⌘⇧C Copy token

Your token is decoded locally — nothing is sent to any server.

Your decoded token appears here

Paste a JWT on the left to inspect its header, payload claims, and signature in real time. Nothing leaves your browser.

JWT Reference

Everything you need to understand JSON Web Tokens — from structure to security.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe string that encodes claims between two parties. It has three Base64url-encoded parts separated by dots:

header.payload.signature

The header declares the algorithm. The payload contains the claims (user data, permissions, expiry). The signature proves the token wasn't tampered with — but only if you verify it server-side.

Is it safe to decode a JWT here?

Yes. The header and payload are not encrypted — they're only Base64url-encoded. Decoding reveals the content but doesn't break any security. This tool decodes entirely in your browser. No token data is ever sent to a server.

The signature is what provides authenticity — but verifying it requires your secret or public key, which stays with you.

What does alg: none mean — and why is it dangerous?

alg: none tells the server to skip signature verification entirely. An attacker can forge any token, set any claims (admin: true, sub: any-user), and a vulnerable server will accept it without question.

This is CVE-2015-9235, a critical vulnerability that affected many JWT libraries. Never accept tokens with alg: none in production. Most modern libraries reject them by default, but always confirm.

What are the standard JWT claims?
ClaimNameMeaning
issIssuerWho created the token (e.g. your auth server URL)
subSubjectWho the token is about (usually a user ID)
audAudienceWho should accept the token (your API's identifier)
expExpirationUnix timestamp — reject after this time
iatIssued AtUnix timestamp — when the token was created
nbfNot BeforeUnix timestamp — reject before this time
jtiJWT IDUnique token ID — use to prevent replay attacks
HS256 vs RS256 vs ES256 — which should I use?

HS256 (HMAC-SHA256) uses a shared secret. Both the issuer and every verifier need the same secret. Simple to set up but risky if the secret leaks. Use when you control both sides.

RS256 (RSA-SHA256) uses a key pair. The issuer signs with a private key; any service verifies with the public key. Ideal for APIs where multiple services need to verify tokens without sharing secrets. Used by Auth0, Google, Azure AD.

ES256 (ECDSA-SHA256) is like RS256 but with smaller key sizes and faster operations. Preferred for modern systems.

What is JWK / JWKS endpoint verification?

A JWKS (JSON Web Key Set) endpoint is a URL that exposes a provider's public keys in a standard format — e.g. https://accounts.google.com/.well-known/jwks.json. Instead of manually pasting a public key, you provide the JWKS URL and the tool fetches the keys and verifies your token's signature automatically. This is how Auth0, Google, Firebase, Cognito, and Okta publish their signing keys.

How do I debug a JWT from Auth0, Firebase, or Cognito?

Paste your token in the Decoder. The tool auto-detects the provider from the iss claim and shows the JWKS URL so you can verify with one click.

  • Auth0: iss matches your Auth0 domain. JWKS at https://<domain>/.well-known/jwks.json
  • Firebase: iss = https://securetoken.google.com/<project-id>
  • Cognito: iss is your Cognito User Pool URL. Check token_use to distinguish access vs ID tokens.
Why should I always validate exp server-side?

An expired token should be rejected even if the signature is valid. Never trust a token that has passed its exp time. Common pitfalls:

  • Clock skew — allow a small tolerance (30–60s) between servers
  • Missing exp — tokens without expiry never expire. Treat as high risk.
  • Long-lived tokens — tokens valid for 7+ days increase blast radius on compromise. Use short-lived access tokens + refresh tokens instead.
What is the aud claim and why does it matter?

The audience claim specifies who the token is intended for. If your API's identifier is https://api.example.com, it should reject any token where aud doesn't match.

Without aud validation, a token issued for Service A could be replayed against Service B — a serious privilege escalation if both services trust the same issuer.

How do I generate a JWT token online?

Open the Generator tab. Choose a signing algorithm (HS256, HS384, HS512, RS256, ES256 or none), fill in standard claims like sub, iss and aud, set an expiry, add any custom claims, and provide your HMAC secret or PEM private key. Click Generate Token to mint a ready-to-use, signed JWT. It is a complete JWT encoder and JWT generator that runs entirely in your browser, so your secret never leaves the page.

How do I create a test JWT with custom claims?

In the Generator, click Add claim to insert custom key/value pairs. Values are auto-typed: true/false become booleans, numbers become numbers, and valid JSON like ["a","b"] or {"k":1} is parsed as an array or object. This makes it easy to create a JWT token online with roles, permissions, or any application-specific data for testing your auth flow.

Can I edit a JWT payload and re-encode it?

Yes. After decoding a token, click Edit on the Payload card to open an inline JSON editor. Change any claim and click Apply — the token is re-encoded live so you can quickly fabricate edge-case tokens for testing. The re-encoded token is unsigned (the signature is dropped) because signing requires a key. To produce a properly signed token, copy the edited payload into the Generator and sign it there.

How do I verify a JWT using a JWKS URL?

When you decode a token signed with an asymmetric algorithm (RS256/ES256), a JWKS Endpoint Verify panel appears. If the provider is recognised from the iss claim, the JWKS URL is filled in automatically — otherwise paste it yourself, e.g. https://<your-domain>/.well-known/jwks.json. Click Fetch & Verify and the tool downloads the public keys, matches the token's kid, and confirms the signature. Note that some providers block cross-origin browser requests; in that case, paste the public key into the Verify Signature panel instead.

How do I compare two JWTs?

Open the Diff tab, paste a token into Token A and Token B, and click Compare Tokens. The JWT diff comparator highlights every claim that was added, removed, or changed across both the header and payload, and shows the expiry difference between the two tokens. It is ideal for debugging token-refresh issues or comparing a development token against a production one.

What is the JWT security audit report?

The Security Report tab scores any decoded token out of 100 and grades it from Critical to Excellent. It runs a pass/fail checklist covering the dangerous alg: none vulnerability, missing exp, aud or iss, absent kid, overly long lifetimes, and replay-protection (jti). It also shows a lifetime risk band and a full claims inventory, and you can download the whole report as JSON for security reviews or audit trails.

How do I get a cURL or fetch command for my JWT?

Decode a token, then open the Snippets tab. It generates ready-to-copy code that sends your token as an Authorization: Bearer header in cURL, fetch, axios, Python (requests), Go, plus terminal one-liners for jwt-cli, jq, and Python. Copy the snippet straight into Postman, your terminal, or a CI/CD pipeline.

Does this tool keep a history of my tokens?

Yes — the History tab keeps a list of recently decoded tokens so you can switch between them without re-pasting. The history is in-memory and session-only: nothing is written to localStorage or any server, and it is cleared the moment you close the tab. Click any entry to reload it instantly.

How do I decode a JWT token online?

To decode a JWT token online, paste it into the input box at the top of this page. The decoder instantly Base64url-decodes the header and payload and shows them as formatted JSON — no button to press, no upload, and no account needed. You can also pass a token in the URL to share a decoded view. It works as a drop-in JWT chrome extension alternative and a browser-based JWT decode python alternative — no install, no script.

How do I check if a JWT is expired?

Decode the token and look at the exp claim. It is a Unix timestamp (seconds since 1970-01-01). If that time is in the past, the token is expired. This tool converts exp, iat and nbf into readable dates with a live countdown and labels the token as active, not-yet-valid, or expired automatically, so you do not have to do the math.

How do I read the JWT payload?

The payload is the middle segment of the token, between the two dots. It is Base64url-encoded JSON, not encrypted, so it can be read by anyone. Paste the token above and the JWT payload decoder renders the claims with plain-English explanations next to each value. You can copy the raw payload JSON with one click.

Can a JWT be decoded without the secret key?

Yes. The header and payload are only Base64url-encoded, so they can be decoded without any secret or key — that is exactly what this tool does. The secret (HS256) or public key (RS256/ES256) is only needed to verify the signature, which proves the token has not been tampered with. So you can decode a JWT without verification to read it, then optionally verify it when you have the key.

What is a JWT token, explained simply?

A JWT (JSON Web Token) is a signed, URL-safe string used to prove identity between services. It has three parts joined by dots: header.payload.signature. The header says how it is signed, the payload carries the claims (the data), and the signature lets a server confirm the token is authentic. The header and payload are just encoded JSON, while the signature is cryptographic.

What is the difference between a JWT and a session token?

A session token is an opaque random ID; the server stores the matching session data and looks it up on every request (stateful). A JWT is self-contained: the claims live inside the token and the server validates it by checking the signature, so no central lookup is required (stateless). JWTs scale well across services but are harder to revoke before expiry — which is why short exp times and refresh tokens matter.

How does JWT authentication work?

When a user logs in, the server issues a signed JWT. The client sends it back on each request, usually in the Authorization: Bearer <token> header. The server verifies the signature, checks exp, aud and iss, and then trusts the claims inside. Use this tool to debug JWT authentication by inspecting exactly what your bearer token contains and whether it verifies.

What are JWT security best practices?
  • Always verify the signature server-side; reject alg: none.
  • Validate exp, nbf, aud and iss on every request.
  • Use short-lived access tokens plus refresh tokens.
  • Prefer asymmetric algorithms (RS256/ES256) when multiple services verify tokens.
  • Never put secrets or sensitive PII in the payload — it is readable by anyone.
  • Pin expected algorithms; do not let the token's header dictate the verification algorithm.
Can I use this instead of a Postman or Chrome extension to inspect a JWT?

Yes. Copy the JWT from your Authorization header (drop the Bearer prefix) and paste it here to inspect it in the browser. It is a fast Postman alternative and JWT chrome extension alternative for reading bearer tokens, with claim explanations, an expiry check, a structure validator, and optional signature verification — all without sending your token anywhere.

The Free Online JWT Decoder, Encoder & Toolkit for Developers

JWT Dev Tools is a fast, private JWT decoder and JWT encoder that lets you decode a JWT token, generate a new signed token, verify signatures, compare two tokens, and audit security — all without your data ever leaving the browser. Paste a token to decode the JWT payload and header in real time, or switch to the JWT generator to create a JWT token online with custom claims, expiry, and algorithm. No signup, no login, no waiting.

JWT Generator & Encoder — Create Test Tokens

The built-in JWT generator and JWT encoder lets you fill in the header algorithm, payload fields, and a secret or private key to produce a ready-to-use token. Generate HS256, HS384, HS512, RS256 and ES256 tokens, set exp, nbf, aud, iss and any custom claims, then copy the signed token straight into your tests. You can also edit the decoded payload and live re-encode it — the feature jwt.io users missed most — to quickly fabricate edge-case tokens for debugging.

Verify Signatures with JWKS Endpoints & Provider Auto-Detection

Instead of pasting a public key by hand, give the tool a JWKS URL and it fetches the provider's public keys and verifies your token's signature automatically. The token provider auto-detection inspects the iss claim to recognise Auth0, Google, Firebase, AWS Cognito, Azure AD, Okta, Apple and GitHub tokens and links the correct JWKS endpoint. It supports RS256, ES256 and HS256 verification right in the browser using the Web Crypto API.

JWT Diff, Security Audit & Code Snippets

The JWT diff comparator highlights exactly what changed between two tokens — added, removed and modified claims plus expiry differences — perfect for debugging token refresh issues or comparing dev versus prod tokens. The security audit report scores a token out of 100, flags the dangerous alg: none vulnerability, missing aud or exp, long lifetimes and more, and exports a downloadable JSON report. The code snippet generator produces ready-to-copy cURL, fetch, axios, Python, Go, jwt-cli and jq commands so you can send the token as a Bearer header in seconds.

Decode a JWT Token in Real Time

A JSON Web Token is three Base64url-encoded segments joined by dots. Our JWT token decoder decodes the JWT payload and header as you type, so you see the result immediately. Because decoding only Base64url-decodes the data, you can decode a JWT without a secret — the secret or public key is only ever needed to verify the signature, not to read the contents. That makes this a true JWT payload decoder and JWT header decoder rolled into one. Use the sample token button if you want to see how the JWT decode flow works before pasting your own.

A JWT Token Inspector, Debugger and Validator

Beyond raw JWT decode base64 output, this tool acts as a full JWT token inspector and JWT debugger. Every standard claim — iss, sub, aud, exp, iat, nbf and jti — is explained in plain English next to its value, so you do not have to memorize the spec. As a JWT decoder and validator, it can verify RS256, ES256 and HS256 signatures right in the browser using the Web Crypto API. Paste a PEM public key or a JWKS document for asymmetric algorithms, or your shared secret for HMAC, and confirm whether the token was really signed by who you expect.

JWT Expiry Checker and Security Scanner

Auth bugs usually come down to timing and trust. The built-in JWT expiry checker converts exp, iat and nbf timestamps into human-readable dates with a live countdown, so you can tell at a glance whether a token is active, not-yet-valid, or expired. The security scanner flags the dangerous alg: none vulnerability, missing aud claims, absent expiry, and other risky patterns — and the downloadable security audit report turns a plain JSON Web Token decoder into a practical security review tool for production tokens.

Debug JWTs from Auth0, Firebase, Cognito, Azure AD & Google

Use this as your Auth0 JWT decoder, Firebase JWT decoder, Cognito JWT decoder, Azure AD JWT decoder or Google JWT decoder — the format is the same across every provider, and the tool auto-detects which one issued your token from the iss claim. Copy the token out of your Authorization header (drop the Bearer prefix) and paste it here to decode the bearer token, read its claims, and verify the signature against the provider's JWKS endpoint. It is the fastest way to inspect a JWT in the browser and a clean JWT chrome extension alternative, JWT decode python alternative, and Postman alternative. Whether you are chasing a 401, an audience mismatch, or an expired session, this is a practical way to debug JWT authentication and parse a JWT token online.

JWT Structure Validator & Malformed Token Checker

Not every string that looks like a token is valid. This JWT token format checker and JWT structure validator confirms there are exactly three Base64url parts and surfaces a clear message when something is off — so you can fix a malformed JWT error, catch an invalid JWT token, or spot a token that is truncated or too long because of a copy-paste slip. Combined with the built-in JWT token analyzer, signature check, and JWT encoder, you can decode, verify and generate a JWT all in one place.

Private by Design — JWT Decode & Encode With No Login

Tokens often contain sensitive data, so privacy matters. Every operation runs locally in JavaScript and nothing is ever transmitted to a server. There is genuinely JWT decode no login and no sign up — session history stays in memory and is gone when you close the tab. Whether you are debugging a token from Auth0, Firebase, Cognito, Okta or your own API, it is a safe JWT token reader, encoder and validator with full confidence.