JWT Token Decoder
Instantly decode and inspect JSON Web Tokens. View header, payload, expiry status, security warnings, and all standard JWT claims 100% runs in your browser.
Paste any JWT token to decode its header and payload, check expiry status, view security warnings, and inspect all claims with explanations.
Related Developer Tools
Free tools that work alongside the JWT decoder in your development workflow.
What Is JWT? JSON Web Token Explained
JWT stands for JSON Web Token. The full form of JWT is JSON Web Token, pronounced as jot. It is an open industry standard defined by RFC 7519 for securely transmitting information between two parties as a compact, URL-safe string. JWT meaning in web development is essentially a self-contained token that proves who a user is and what they are allowed to do, without the server needing to look anything up in a database.
JWT authentication is the most widely used method for securing REST APIs in 2026. When you log into any modern web application, a banking app, a SaaS product or a mobile application, there is a very high chance that a JWT token is being used behind the scenes to keep your session secure. The token travels with every API request in the Authorization: Bearer header, allowing the server to verify your identity without maintaining server-side session state.
The popularity of JWT comes from three practical advantages over older session-based authentication. JWTs are stateless, meaning the server does not need to store session data in a database or shared memory. They are portable, working across multiple services, microservices and mobile clients without coordination. And they are self-describing, carrying all the information about the user and their permissions directly inside the token itself.
How JWT Authentication Works Step by Step
Understanding how JWT authentication works helps you debug token issues, choose the right algorithm and implement secure APIs. Here is the complete JWT auth flow that happens every time a user logs in to a modern web application.
The user submits their username and password to the authentication endpoint (typically POST /login or POST /auth/token). The server validates the credentials against the database.
On successful login, the server builds a JWT payload containing claims like sub (user ID), email, roles and exp (expiry time). It signs the header and payload using the chosen algorithm HS256 with a secret key or RS256 with a private key to produce the signature.
The server returns the JWT to the client. The client stores it, ideally in an httpOnly cookie (most secure) or in memory. Storing JWTs in localStorage makes them vulnerable to XSS attacks.
For every subsequent API call, the client includes the JWT in the Authorization header: "Authorization: Bearer eyJ...". This is how the server knows who is making the request.
The server decodes the token, verifies the signature using the secret or public key, checks that the exp claim has not passed and validates the iss and aud claims. If all checks pass, the request is processed. No database lookup required.
JWT Structure: Header, Payload and Signature Explained
A JWT token is made up of three parts separated by dots. Each part is Base64URL encoded, which is why JWT tokens always start with eyJ (the Base64URL encoding of the opening {" of a JSON object).
The JWT header is a JSON object containing two fields. alg specifies the signing algorithm and typ is always "JWT". The algorithm choice directly affects security. Use RS256 or ES256 for production systems. Never use alg:none.
{
"alg": "HS256",
"typ": "JWT"
}The JWT payload contains claims. Standard claims include sub (subject, the user ID), exp (expiration, a Unix timestamp), iat (issued at), iss (issuer) and aud (audience). You can add any custom claims like roles or email. Remember: the payload is not encrypted, only Base64URL encoded. Anyone who gets the token can read it. Use our Base64 decoder to see this yourself.
{
"sub": "user_12345",
"email": "alice@example.com",
"role": "admin",
"iat": 1700000000,
"exp": 1700003600
}The signature is produced by combining the encoded header and payload, then signing them with the chosen algorithm and key. For HS256: HMACSHA256(base64url(header) + "." + base64url(payload), secret). This prevents tampering. If any bit of the header or payload changes, the signature verification fails and the server rejects the token. Note: this tool decodes the header and payload but cannot verify the signature since that requires your server's secret or public key.
JWT vs Session Tokens: Key Differences
Before JWT, the dominant authentication method was server-side sessions. Understanding the difference helps you choose the right approach for your application.
| Aspect | JWT Token | Session Token |
|---|---|---|
| Storage | Client (cookie or memory) | Server database or memory |
| State | Stateless no server lookup | Stateful DB query per request |
| Revocation | Difficult without extra infra | Easy delete session record |
| Scalability | Excellent for microservices | Requires shared session store |
| Token size | Larger (claims included) | Small (just an ID) |
| Expiry | Built into exp claim | Managed server-side |
| Use case | APIs, mobile, microservices | Traditional web apps |
JWT is not always better than sessions. If you need instant token revocation (like logging out all devices immediately), sessions are simpler. If you are building APIs consumed by mobile apps, third-party services or microservices across multiple servers, JWT is the standard choice. Many production systems use both: short-lived JWTs for access and a session or refresh token mechanism for renewal.
Common JWT Errors and What They Mean
If you work with JWT authentication long enough, you will encounter these error messages. Here is what each one means and how to fix it. Use this decoder tool to inspect the token when debugging any of these errors.
JWT Signing Algorithms Explained: HS256 vs RS256 vs ES256
The algorithm specified in the JWT header determines how the signature is created and verified. Choosing the wrong algorithm is one of the most common JWT security mistakes.
How to Use the JWT Decoder Tool
The TOOLBeans JWT decoder is the fastest way to inspect any JSON Web Token in your browser. Here is how to get the most out of it.
Your JWT token is decoded entirely in your browser using JavaScript. The token string is never sent to any server and is never logged. This tool is safe to use with production tokens, tokens containing real user data and tokens from live applications. All processing is local.