decode jwt
How to decode a JWT online
A JSON Web Token has three Base64URL segments separated by dots: header.payload.signature. Decoding means reading the JSON in the first two parts—essential for debugging auth, expired sessions, and bad claims without verifying the signature on every debug step.
Anatomy of a JWT
The header usually includes alg (HS256, RS256…) and typ. The payload holds claims such as sub, iss, aud, iat, and exp. The signature proves integrity when verified with the right key. During debugging, reading the payload is often enough to see why middleware rejected a request.
Steps to decode
1) Copy the full token (Bearer prefix is fine). 2) Paste it into the LedaTools JWT decoder. 3) Inspect header and payload as JSON. 4) Check expiry warnings. Everything runs in your browser; the token is not uploaded for processing.
Common mistakes
Mixing up exp in seconds vs milliseconds, assuming decode means verify, or pasting only the payload. Another frequent risk: pasting production tokens into untrusted third-party decoders—treat those tokens as secrets.
Privacy
Prefer a local or client-side decoder. LedaTools Base64URL-decodes on your device—ideal for staging tokens and understanding claims without exposing credentials.
Decode vs verify?
Decode only reveals contents. Verify checks the signature with a secret or public key. Use decode to inspect; use your auth library (jose, jsonwebtoken, etc.) to trust the token.
When to use LedaTools
When you need to see claims instantly, compare iat/exp, or show a teammate what the token carries—without installing a CLI or pasting secrets into opaque sites.
FAQ
Is this JWT decoder free?
Yes. No signup required.
Does my JWT leave the browser?
No. Decoding runs locally on your device.
Does it verify signatures?
No. It only decodes contents; it does not verify signatures.