JWT Decoder
Decode and inspect JSON Web Tokens.
About JWT Decoder
The GuruAlpha JWT Decoder parses and displays the contents of JSON Web Tokens (JWTs) in a readable format. Paste a JWT and the tool decodes the header, payload and signature, displaying each section with syntax highlighting. Essential for debugging authentication, verifying token claims and understanding API security.
JWT (JSON Web Token) is the most widely used authentication token format in modern web applications. A JWT consists of three Base64-encoded sections separated by dots: header (algorithm and token type), payload (claims and user data), and signature (verification hash). Understanding JWT contents is essential for debugging authentication flows, verifying user permissions and diagnosing API errors.
The tool decodes all three JWT sections. The header typically contains the signing algorithm (RS256, HS256, etc.) and token type. The payload contains claims — standard fields like sub (subject/user ID), iss (issuer), exp (expiration), iat (issued at) and custom claims like roles, permissions and user metadata. The signature section is displayed but not verified (signature verification requires the signing key).
The decoded output is displayed with syntax highlighting: keys in blue, string values in green, numbers in orange and boolean/null values in purple. Expired tokens are flagged with a red warning. Token lifetime is calculated and displayed. The time until expiration is shown for valid tokens.
For developers, the JWT Decoder is an essential debugging tool. When API calls fail with 401 Unauthorized, pasting the token into the decoder reveals whether it's expired, has wrong permissions or contains incorrect user data. The decoded claims help identify exactly what the server expects and what the token provides.
Key Features of JWT Decoder
- Decode JWT header, payload and signature sections
- Syntax-highlighted JSON output
- Expiration detection with warning
- Token lifetime calculation
- Standard and custom claims display
- Base64 decoding for each section
- Browser-based for privacy
- No token data sent to servers
How to Use JWT Decoder
- Open the JWT Decoder on GuruAlpha.
- Paste your JWT in the input field.
- The three sections decode automatically.
- View the header (algorithm and type).
- View the payload (claims, user data, expiration).
- Check for expiration warnings.
- Copy individual sections for debugging.
Tips for Using JWT Decoder
- Check the exp claim to verify if a token is expired.
- The header tells you the signing algorithm — useful for verification.
- Custom claims in the payload show user roles, permissions and metadata.
- The tool does NOT verify signatures — that requires the signing key.
- Use this to debug 401 Unauthorized errors in API calls.
Frequently Asked Questions About JWT Decoder
What is a JWT?
A JSON Web Token is a compact, URL-safe token used for authentication. It contains encoded claims (user ID, expiration, permissions) signed by the server.
Can this verify JWT signatures?
No. Signature verification requires the server's private signing key. The decoder only displays the decoded contents for inspection.
Why is my token expired?
JWTs have an exp (expiration) claim. Once the current time passes the expiration, the token is invalid. Request a new token from the authentication endpoint.
What claims are standard?
Standard claims include: sub (subject), iss (issuer), aud (audience), exp (expiration), iat (issued at), nbf (not before).