Decode JWT Online

Paste or upload a JWT to decode it and view the token content in a readable format in seconds.

JWT Decoder — Decode and Inspect JSON Web Tokens Online

Decode any JSON Web Token instantly in your browser with the XConvert JWT Decoder. Paste a JWT string and view the decoded header, payload, and signature without sending your token to a server. This free, client-side tool keeps your tokens private while giving you full visibility into their contents.

JSON Web Tokens are the backbone of modern authentication and authorization systems. Whether you are debugging an OAuth flow, verifying token claims before they reach production, or simply learning how JWTs work, having a reliable decoder at your fingertips saves time and reduces risk. The XConvert JWT Decoder parses all three parts of a JWT — header, payload, and signature — and presents them in a clean, readable JSON format so you can inspect every claim at a glance.

How to Decode a JWT with XConvert (4 Steps)

  1. Open the JWT Decoder — Navigate to the XConvert JWT Decoder page in any modern browser. No installation or account is required.
  2. Paste Your Token — Copy the full JWT string (the three Base64URL-encoded segments separated by dots) and paste it into the input field.
  3. View Decoded Output — The tool instantly splits the token into its header, payload, and signature sections. Each section is displayed as formatted JSON with syntax highlighting.
  4. Inspect Claims — Review registered claims such as iss, sub, aud, exp, nbf, and iat, along with any custom claims your application has added. Check expiration timestamps against the current time to verify token validity.

Because the entire decoding process runs in your browser using JavaScript, the token never leaves your machine. This is critical when working with tokens that contain sensitive user data or access credentials. There is no need to install browser extensions, desktop applications, or command-line utilities — the tool works immediately in any modern browser on desktop or mobile.

What Is a JSON Web Token (JWT)?

A JSON Web Token is a compact, URL-safe string that represents a set of claims between two parties. Defined by RFC 7519, a JWT consists of three parts separated by periods: a header, a payload, and a signature.

The header typically contains two fields — alg, which specifies the signing algorithm (such as HS256 or RS256), and typ, which is usually set to JWT. The payload carries the claims, which are statements about an entity (usually the user) and additional metadata. Claims fall into three categories: registered claims (standardized fields like exp and iss), public claims (defined in the IANA JSON Web Token Claims registry), and private claims (custom fields agreed upon by the parties exchanging the token). The signature is created by encoding the header and payload, then signing them with a secret or private key using the algorithm specified in the header.

JWTs are widely used in OAuth 2.0, OpenID Connect, API authentication, single sign-on (SSO) systems, and microservice-to-microservice communication. Their self-contained nature means the server does not need to query a database to validate the token — all the necessary information is embedded within the token itself.

Comparison Table

Feature XConvert JWT Decoder jwt.io Command-Line Tools
Client-side decoding ✅ Yes ✅ Yes ✅ Yes
No account required ✅ Yes ✅ Yes ✅ Yes
Signature verification ❌ Decode only ✅ Yes ✅ Yes
Works offline ✅ Yes (after load) ❌ No ✅ Yes
Formatted JSON output ✅ Yes ✅ Yes Depends on tool
Expiration check ✅ Visual indicator ✅ Visual indicator Manual
Privacy ✅ Never leaves browser ⚠️ Check policy ✅ Local
Mobile-friendly ✅ Responsive ✅ Responsive ❌ No
Cost Free Free Free

Common Use Cases

  1. Debugging Authentication Flows — When an API returns a 401 or 403 error, decoding the JWT lets you verify whether the token has expired, whether the audience claim matches the expected value, and whether the required scopes are present.

  2. Inspecting OAuth 2.0 Access Tokens — OAuth providers like Auth0, Okta, and AWS Cognito issue JWTs as access tokens. Decoding them reveals the granted scopes, the issuer URL, and the token lifetime — all essential for troubleshooting authorization issues.

  3. Verifying Token Expiration — The exp claim contains a Unix timestamp indicating when the token expires. Paste the token into the decoder, then use the Unix Timestamp to Date Converter to convert the exp value into a human-readable date and confirm whether the token is still valid.

  4. Reviewing Custom Claims — Many applications embed custom data in JWTs, such as user roles, tenant IDs, or feature flags. Decoding the token lets you confirm that these claims are set correctly before the token is consumed by downstream services.

  5. Learning and Education — If you are new to JWTs, decoding sample tokens is one of the fastest ways to understand the structure. You can see exactly how the header, payload, and signature relate to each other.

  6. Security Auditing — Security teams decode JWTs to check for overly permissive claims, excessively long expiration times, or the use of weak signing algorithms like none or HS256 with a guessable secret.

Technical Details of JWT Decoding

A JWT is encoded using Base64URL, which is a URL-safe variant of Base64 that replaces + with -, / with _, and omits padding characters (=). The XConvert JWT Decoder reverses this encoding for the header and payload segments, then parses the resulting strings as JSON. The signature segment is displayed in its raw Base64URL form because interpreting it requires the signing key, which the decoder intentionally does not request.

It is important to understand that decoding a JWT is not the same as verifying it. Decoding simply reveals the contents of the token — anyone can do this because the header and payload are not encrypted, only encoded. Verification, on the other hand, involves checking the signature against a known secret or public key to confirm that the token has not been tampered with. The XConvert JWT Decoder focuses on decoding because its primary purpose is inspection and debugging, not cryptographic validation.

When working with RS256-signed tokens, the header will contain a kid (Key ID) field that identifies which public key from the issuer's JWKS (JSON Web Key Set) endpoint should be used for verification. While the decoder does not perform this verification step, seeing the kid value helps you identify the correct key when you need to verify the token programmatically.

Tips for Best Results

  1. Always decode in a private context — Even though the XConvert decoder is client-side, avoid pasting production tokens on shared or public computers. Treat JWTs like passwords.
  2. Check the alg field first — The algorithm in the header tells you how the token was signed. If you see none, the token is unsigned and should not be trusted in production.
  3. Compare exp and iat timestamps — The difference between the issued-at time and the expiration time reveals the token's intended lifetime. Use the Timestamp to Date Converter for quick conversion.
  4. Look for nested JWTs — Some systems embed a JWT inside another JWT's claims. If a claim value looks like a Base64-encoded string with dots, try decoding it separately.
  5. Use the decoder alongside your API client — When testing APIs with tools like Postman or curl, decode the token before sending the request to confirm it contains the expected claims.
  6. Bookmark the tool — Since the decoder works offline after the initial page load, bookmarking it ensures you always have quick access during debugging sessions.

Frequently Asked Questions

Is it safe to paste my JWT into an online decoder?

Yes, when using the XConvert JWT Decoder. The tool runs entirely in your browser using client-side JavaScript. Your token is never transmitted to any server. However, you should still avoid pasting production tokens on shared or untrusted devices.

Can the JWT Decoder verify the token's signature?

No. The XConvert JWT Decoder is designed for inspection and debugging. It decodes the header and payload so you can read the claims, but it does not verify the cryptographic signature. For signature verification, you need the signing key and a library like jsonwebtoken (Node.js) or PyJWT (Python).

What happens if I paste an invalid JWT?

The decoder will attempt to parse the input. If the string does not contain three dot-separated segments or if the Base64URL decoding fails, the tool will display an error message indicating that the input is not a valid JWT.

Can I decode encrypted JWTs (JWE)?

The XConvert JWT Decoder handles signed JWTs (JWS). Encrypted JWTs (JWE) require a decryption key to reveal the payload, which is beyond the scope of this tool. If you encounter a JWE, you will need the appropriate private key and a compatible library to decrypt it first.

What are registered claims in a JWT?

Registered claims are a set of predefined, standardized fields defined in RFC 7519. They include iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). These claims are not mandatory but are recommended for interoperability.

Why does my decoded payload show numbers for exp and iat?

The exp, nbf, and iat claims use Unix timestamps — the number of seconds since January 1, 1970 (UTC). To convert these to human-readable dates, use the Unix Timestamp to Date Converter.

Can I edit the JWT after decoding it?

The XConvert JWT Decoder is read-only. Modifying a JWT's payload would invalidate its signature, making the token unusable. If you need to create or modify JWTs for testing, use a library that can re-sign the token with the appropriate key.

What is the difference between HS256 and RS256?

HS256 (HMAC with SHA-256) uses a shared secret key for both signing and verification. RS256 (RSA with SHA-256) uses an asymmetric key pair — a private key for signing and a public key for verification. RS256 is generally preferred in distributed systems because the public key can be shared without compromising the signing key.

Does the decoder support JWTs with custom headers?

Yes. The decoder parses the entire header object, including any custom fields beyond alg and typ. Fields like kid, jku, x5c, and custom headers will all be displayed in the decoded output.

Can I use this tool on mobile devices?

Yes. The XConvert JWT Decoder is fully responsive and works on smartphones and tablets. The interface adapts to smaller screens while maintaining full functionality, making it convenient for on-the-go debugging.

Decoding JWTs is a foundational skill for any developer working with modern authentication systems. Whether you are building OAuth integrations, debugging API authorization failures, or auditing token security, the XConvert JWT Decoder provides a fast, private, and reliable way to inspect token contents without writing a single line of code.

Related XConvert Tools: Base64 Encoder/Decoder · JSON Formatter · Unix Timestamp to Date · HTML Entity Encoder · URL Encoder/Decoder