Polymorpher
The Utility Factory — Free Developer Tools
Convert, transform, beautify & decode — all in one place.
⚡ All Tools
Did You Know?
Select a tool from the sidebar to get started, or explore our free developer utilities.
About this Tool
JWT Token Decoder — Inspect Header & Payload
Decode JSON Web Tokens (JWT) instantly to inspect their header and payload without needing the signing secret. Paste any JWT and see the decoded JSON with proper formatting — algorithm, token type, claims, expiration, issuer, and all custom fields.
Essential for debugging OAuth2 flows, inspecting API authentication tokens, verifying token claims, and understanding JWT structure. The decoder handles both URL-safe Base64 encoding and standard Base64 with automatic padding correction.
Note: This tool decodes but does not verify JWT signatures. Signature verification requires the signing secret/key. Your tokens are never stored or logged — 100% stateless and privacy-safe.
Live Examples
Example 1 — Decode a standard JWT
Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output:
═══ HEADER ═══
{ "alg": "HS256", "typ": "JWT" }
═══ PAYLOAD ═══
{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
═══ SIGNATURE ═══
⚠️ Signature is present but NOT verified (no secret key).
Example 2 — Check token expiration
Look for the exp claim in the decoded payload. The value is a Unix timestamp — use DateTime Converter to see the actual date.
"exp": 1735689600 → January 1, 2025 00:00:00 UTC
Example 3 — Inspect OAuth2 scopes
OAuth2 tokens often include a scope or scp claim listing permitted actions:
"scope": "read:users write:posts admin"
Decode the token to verify which permissions were actually granted.
JWT Structure (RFC 7519)
A JWT consists of three Base64URL-encoded segments separated by dots:
- Header — Algorithm (
alg) and token type (typ) - Payload — Claims (sub, iss, exp, iat, custom fields)
- Signature — Cryptographic signature verifying integrity
Common Claims Reference
| Claim | Meaning |
|---|---|
sub | Subject (user ID) |
iss | Issuer (who created the token) |
exp | Expiration time (Unix timestamp) |
iat | Issued at (Unix timestamp) |
aud | Audience (intended recipient) |
scope | Permissions / scopes |
When to Use
- Debugging "401 Unauthorized" errors by inspecting token claims
- Verifying token expiration before sending API requests
- Checking OAuth2 scopes and permissions
- Understanding the algorithm used for signing
When Not to Use
- Signature verification: This tool decodes only — use a JWT library with the secret key for validation
- Production token handling: Never paste production tokens containing sensitive data into any online tool (this tool is stateless, but be cautious)
Related Tools: Base64 Encoder · Hash Generator · JSON to Classes