Does decoding a JWT verify it?

No. Decoding only reads token content. Signature verification must be performed with the correct secret or public key on backend.

Why does my API reject a token that looks valid in decoder?

A decoder only parses payload. APIs also validate signature, issuer (iss), audience (aud), expiration (exp), and sometimes token revocation state.

How can I debug exp, iat, and nbf quickly?

Use readable timestamp fields in this page and compare with your server current time in UTC. Many auth issues come from timezone confusion or clock drift.

Can I decode JWT safely on this page?

Yes. Decoding happens in your browser. Still, avoid pasting production tokens with sensitive claims into third-party tools.

JWT Decoder Online (Decode JSON Web Tokens Instantly)

What Is a JWT Token?

JSON Web Token (JWT) is a compact token format used for authentication and authorization. A JWT has three parts separated by dots: header, payload, and signature. The header and payload are Base64URL-encoded JSON objects.

This decoder helps you inspect token contents quickly, but it does not verify the signature. Always validate signatures and issuer rules on your backend.

Common Use Cases

Check token expiration (`exp`) and issued-at time (`iat`).
Inspect roles, scopes, and custom claims.
Debug authorization problems in frontend and API requests.
Validate token structure before backend verification.

JWT Payload Field Reference

Field	Meaning	Debug Tip
sub	Subject (user ID)	Check if it matches expected account.
iss	Issuer	Must match trusted auth provider URL.
aud	Audience	Must match your API/app identifier.
exp	Expiration time	Expired token should trigger refresh/login.
iat	Issued-at time	Detect stale tokens in long-lived sessions.
nbf	Not-before time	Token is invalid before this time.
scope / role	Permissions	Use to debug 403/permission denied.

Real Debugging Examples

401 after 1 hour: token `exp` is too short for your expected session duration.
403 on admin endpoint: payload `role` is `user`, not `admin`.
Works locally, fails in prod: `aud` or `iss` differs between environments.
Token not active: `nbf` is in the future due to clock drift.

Example Decoded JWT

Header:
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "user_123",
  "role": "admin",
  "iss": "https://auth.opstools.cc",
  "aud": "opstools-api",
  "iat": 1768800000,
  "exp": 1768803600
}

exp: token expiration time (Unix seconds).
sub: subject identifier, usually user ID.
role: custom claim used for authorization.

Related Tools

Common Mistakes

Decode equals verify: parsing payload is not equivalent to signature verification.
Ignoring `aud` and `iss`: token can be structurally valid but rejected by policy.
Timezone confusion: `exp` is usually UTC seconds, not local time string.
Wrong token type: access token and refresh token are not interchangeable.
Copying truncated token: missing one segment causes parser failure.

Recommended Debug Flow

Decode token in this page to inspect header and payload fields.
If claim fields look encoded or unclear, use Base64 Encode Decode.
Convert `exp` and `iat` with Unix Timestamp Converter.
If token appears in query params or redirect URLs, inspect with URL Encode Decode.
Reproduce HMAC checks in HMAC Generator when debugging HS256 signing.
Finally verify signature and policy checks on backend logs.

JWT Decoder Online

JWT Decoder

Header

Payload

Token Claims (Readable Time)