JWT Decoder Online
Decode JWT tokens instantly in your browser. Inspect headers, payload claims, verify signatures, convert timestamps, and debug JWTs securely with 100% client-side processing.
JWT Input
Paste token, drag file, or upload
What is a JWT?
JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties. Paste a token above to instantly decode and inspect it.
Overview
The ToolMono JWT Decoder & Debugger is an enterprise-grade, browser-based security tool designed for backend engineers, frontend developers, identity specialists, and DevOps architects. Whether you are debugging OAuth 2.0 authorization flows, inspecting OpenID Connect (OIDC) ID tokens, testing API gateway JWT validation middleware, or analyzing session claims, ToolMono decodes and verifies JSON Web Tokens (JWT) instantly in your browser.
Unlike server-side JWT tools that transmit sensitive session tokens and secret keys over HTTP networks, ToolMono executes 100% client-side decoding and signature verification. Built on native browser HTML5 Web Crypto APIs, your private credentials never leave your machine sandbox. For complementary developer workflows, explore our JWT Generator, Base64 Encoder/Decoder, JSON Formatter, JSON Schema Generator, and Hash Generator.
How to Decode a JWT Online
Paste your raw JSON Web Token (the long string containing two periods) or Authorization Bearer header into the input box.
ToolMono instantly decodes Base64Url data into pretty-printed JSON, highlighting standard claims (sub, iss, exp) and converting Unix timestamps.
Enter your HMAC secret string or RSA/ECDSA Public Key PEM to cryptographically verify signature validity, check security health, or export Markdown reports.
What is a JWT & How Does It Work?
A JSON Web Token (JWT) is an open RFC 7519 industry standard representing a compact, URL-safe container for securely transmitting claims between two parties. A standard JWS token consists of three distinct segments separated by dots (.): Header (defines algorithm & type), Payload (contains statement claims), and Signature (ensures data integrity and sender authenticity).
Specifies the signing algorithm (e.g. "alg": "HS256") and token type ("typ": "JWT").
Contains the statements/claims about an entity (user ID, roles, issuer, expiration, scopes).
Calculated by taking the encoded header, encoded payload, secret/private key, and hashing algorithm.
Supported Signature Algorithms
| Algorithm | Key Type | Hash Function | Security Level | Typical Use Cases |
|---|---|---|---|---|
| HS256 / HS384 / HS512 | Symmetric Shared Secret | HMAC + SHA-256/384/512 | Standard | Internal microservices, single backend APIs |
| RS256 / RS384 / RS512 | Asymmetric RSA Key Pair | RSASSA-PKCS1-v1_5 | High Security | Auth0, Okta, Keycloak, OpenID Connect |
| ES256 / ES384 / ES512 | Elliptic Curve (ECDSA) | P-256 / P-384 / P-521 | Ultra Secure | High-performance APIs, modern mobile authentication |
| none | No Key | None | Insecure | ❌ Never use in production |
Standard JWT Claims Reference
| Claim | Meaning | Required? | Example | Specification & Description |
|---|---|---|---|---|
| iss | Issuer | Recommended | "https://auth.example.com" | RFC 7519 Section 4.1.1. Identifies who created and issued the token. |
| sub | Subject | Recommended | "user_1029384" | RFC 7519 Section 4.1.2. Identifies the principal user or service. |
| aud | Audience | Recommended | "https://api.example.com" | RFC 7519 Section 4.1.3. Identifies target recipients intended for the token. |
| exp | Expiration Time | Critical | 1774540800 | RFC 7519 Section 4.1.4. Unix timestamp after which token MUST NOT be accepted. |
| iat | Issued At | Recommended | 1774454400 | RFC 7519 Section 4.1.6. Unix timestamp indicating when token was created. |
| nbf | Not Before | Optional | 1774454400 | RFC 7519 Section 4.1.5. Timestamp before which token MUST NOT be accepted. |
| jti | JWT ID | Optional | "a8f3-491e-92b1" | RFC 7519 Section 4.1.7. Unique identifier used to prevent token replay attacks. |
| kid | Key ID | Header Claim | "rsa-key-2026" | RFC 7515 Section 4.1.4. Header hint indicating which public key signed the token. |
| typ | Type | Header Claim | "JWT" | RFC 7515 Section 4.1.2. Media type of the JWS token. |
Human Timestamp Conversion & Expiration
UTC & Local Time
Unix epoch seconds (e.g. 1774540800) are automatically parsed into full ISO 8601 UTC date-time strings and localized browser time zone strings.
Relative Expiration
Calculates live relative remaining validity (e.g., "Expires in 45 minutes") or time elapsed since issuance.
Expired Token Warnings
Tokens with past exp timestamps trigger immediate red alert banners warning that relying servers will reject requests.
Cryptographic Signature Verification
Symmetric vs. Asymmetric Verification
Symmetric Hashing (HS256)
Uses the same shared secret string on both the issuing authentication server and the decoder verifier. Enter secret string to recalculate HMAC hash.
Asymmetric PKI (RS256 / ES256)
The issuing server signs using a Private Key; anyone with the public PEM certificate or JWKS endpoint can verify authenticity without seeing the private key.
JWT Security Best Practices
Set Short Expiration Times
Keep access token Lifespans short (15–60 minutes) to minimize damage if a token is leaked. Use Refresh Tokens for session renewals.
Store Tokens in HttpOnly Cookies
Store tokens in HttpOnly, Secure, SameSite cookies rather than localStorage to protect against Cross-Site Scripting (XSS) attacks.
100% Client-Side Privacy Architecture
Security Commitment: Zero Server Uploads
Most online JWT decoders transmit tokens over HTTP networks to remote servers, exposing private session tokens and secret keys to logging servers. ToolMono operates under a strict Privacy First architecture:
- Native Web Crypto API Verification
- No Remote Network Uploads
- No Server Logging or Token Storage
- 100% Offline Capable
Developer Code Examples (6 Languages)
1. Node.js (jsonwebtoken)
// Node.js - Using 'jsonwebtoken' Library
const jwt = require('jsonwebtoken');
const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
const secret = "your-256-bit-secret";
// 1. Decode payload without signature verification (Debug mode)
const decoded = jwt.decode(token, { complete: true });
console.log("Header:", decoded.header);
console.log("Payload:", decoded.payload);
// 2. Cryptographically verify signature and claims
try {
const verifiedPayload = jwt.verify(token, secret, { algorithms: ['HS256'] });
console.log("Signature Valid! Claims:", verifiedPayload);
} catch (err) {
console.error("JWT Verification Failed:", err.message);
}2. Python 3 (PyJWT)
# Python 3 - Using 'PyJWT' Library
import jwt
token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
secret_key = "your-256-bit-secret"
# 1. Unverified decode (Inspect payload claims)
unverified_claims = jwt.decode(token, options={"verify_signature": False})
print("Decoded Claims:", unverified_claims)
# 2. Verify signature and expiration claims
try:
verified_payload = jwt.decode(token, secret_key, algorithms=["HS256"])
print("Verified Payload:", verified_payload)
except jwt.ExpiredSignatureError:
print("Error: Token has expired!")
except jwt.InvalidTokenError as e:
print("Error: Invalid signature or token structure:", str(e))3. Java (java-jwt)
// Java 17+ - Using Auth0 'java-jwt' or JJWT
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.auth0.jwt.interfaces.JWTVerifier;
public class JwtDecoderExample {
public static void main(String[] args) {
String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
String secret = "your-256-bit-secret";
// 1. Decode token claims without secret key
DecodedJWT decoded = JWT.decode(token);
System.out.println("Subject: " + decoded.getSubject());
System.out.println("Expires At: " + decoded.getExpiresAt());
// 2. Cryptographically verify token signature
try {
Algorithm algorithm = Algorithm.HMAC256(secret);
JWTVerifier verifier = JWT.require(algorithm).build();
DecodedJWT verified = verifier.verify(token);
System.out.println("Signature Verified for User: " + verified.getSubject());
} catch (Exception e) {
System.err.println("Verification Failed: " + e.getMessage());
}
}
}4. Go (golang-jwt)
// Go - Using 'golang-jwt/jwt' v5
package main
import (
"fmt"
"github.com/golang-jwt/jwt/v5"
)
func main() {
tokenString := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
secretKey := []byte("your-256-bit-secret")
// Parse and verify token signature
token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
}
return secretKey, nil
})
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
fmt.Println("Verified Subject:", claims["sub"])
fmt.Println("Expires At:", claims["exp"])
} else {
fmt.Println("Token Verification Error:", err)
}
}5. C# (.NET Core System.IdentityModel)
// C# .NET Core - System.IdentityModel.Tokens.Jwt
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Text;
using Microsoft.IdentityModel.Tokens;
class Program {
static void Main() {
string token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
string secret = "your-256-bit-secret-key-must-be-long-enough";
var handler = new JwtSecurityTokenHandler();
// 1. Unverified Read
var jsonToken = handler.ReadJwtToken(token);
Console.WriteLine($"Issuer: {jsonToken.Issuer}, Subject: {jsonToken.Subject}");
// 2. Verify Signature & Expiration
var validationParameters = new TokenValidationParameters {
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret)),
ValidateIssuer = false,
ValidateAudience = false,
ClockSkew = TimeSpan.FromMinutes(1)
};
try {
var principal = handler.ValidateToken(token, validationParameters, out var validatedToken);
Console.WriteLine("JWT Token Signature is Valid!");
} catch (Exception ex) {
Console.WriteLine($"Validation Failed: {ex.Message}");
}
}
}6. JavaScript (Native Browser atob & JSON.parse)
// JavaScript (Browser) - Pure Native Client-Side Base64Url Decode
function decodeJWT(token) {
const parts = token.split('.');
if (parts.length !== 3) throw new Error("Invalid JWT format");
const base64UrlDecode = (str) => {
let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
while (base64.length % 4) base64 += '=';
return JSON.parse(decodeURIComponent(escape(atob(base64))));
};
const header = base64UrlDecode(parts[0]);
const payload = base64UrlDecode(parts[1]);
return { header, payload, signature: parts[2] };
}
console.log(decodeJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxw..."));Common JWT Errors & Fixes
jwt decode token expired
The exp (expiration) timestamp claim is in the past. Re-authenticate or request a new token using your refresh token endpoint.
invalid signature / signature verification failed
The HMAC secret or RSA public key used for verification does not match the key used by the issuing server to sign the payload.
OAuth 2.0 & OpenID Connect (OIDC)
Access Token (OAuth 2.0)
Bearer token presented to API resource servers to grant authorized access to scope-protected endpoints.
ID Token (OpenID Connect)
Authentication token containing user profile information (email, sub, name) intended for the client frontend.
AI Overview Answers
What is a JWT Decoder?
A JWT Decoder is a software utility that parses Base64Url-encoded JSON Web Token strings back into readable JSON Header parameters and Payload claims without requiring a secret key.
Does decoding a JWT verify its signature?
No. Decoding simply reads the payload. Signature verification requires calculating the cryptographic hash with a secret key or public certificate to confirm the token has not been tampered with.
Are JWT tokens decoded locally in ToolMono?
Yes. 100% of decoding and verification operations execute locally in your web browser using HTML5 Web Crypto APIs. Nothing is ever uploaded or stored on ToolMono servers.
Frequently Asked Questions
References & Standards
RFC 7519: JSON Web Token (JWT) Specification
Official IETF standard for compact, URL-safe security tokens.
RFC 7515: JSON Web Signature (JWS)
IETF specification for cryptographic signature verification.
JWT.io Official Introduction & Security Standard
Authoritative handbook for JWT architecture and claim verification.
Related Tools
Browse all toolsOnline JWT Generator & Token Signer
Build and sign JSON Web Tokens online for API testing and development. Customize JWT claims and generate signed tokens directly in your browser with 100% client-side processing.
Base64 Encoder Decoder
Free, 100% client-side Base64 encoder and decoder. Convert text, strings, and data to Base64 or Base64URL instantly with UTF-8 support, padding controls, and client-side processing.
JSON Formatter
Free online JSON formatter, beautifier, and validator. Format, indent, minify, and inspect JSON with real-time syntax error detection in your browser. 100% client-side.
JSON Schema Generator
Instantly generate JSON Schema from any JSON payload. Supports Draft 7 and Draft 2020-12 with fast, browser-based processing.
Hash Generator
Generate hashes and file checksums locally in your browser. Compare digests, copy results, and use MD5, SHA-1, SHA-2, SHA-3, BLAKE2, and supported HMAC algorithms.
URL Encoder & Decoder
Free, 100% client-side URL encoder and decoder. Convert text and query parameters into RFC 3986 percent-encoded strings or decode URLs with smart double-encoding detection and structural URL analysis.