JWT Decoder & Debugger

Name: JWT Decoder
Availability: InStock
Author: Rocket Dev Tools

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is an open industry standard (RFC 7519) used for securely transmitting claims between two parties. JWTs are compact, URL-safe, and commonly used for authentication and authorization in modern REST APIs, Single Sign-On (SSO), and OAuth 2.0 / OpenID Connect flows.

Structure of a JWT: The 3 Parts

A JWT is composed of three parts separated by periods (.):

1. Header (Red)

Defines the token type (usually JWT) and the cryptographic signing algorithm being used (e.g., HS256 or RS256).

2. Payload (Purple)

Contains the claims (user ID, roles, permissions, expiration timestamp). It is Base64URL-encoded JSON data.

3. Signature (Cyan)

Generated by hashing the encoded header and payload with a secret key or private key to ensure authenticity.

How to Decode a JWT Programmatically

Because the payload is simply Base64URL-encoded, you don't need a heavy cryptographic library just to inspect or read claims:

Node.js / JavaScript (Native)

// Decode JWT payload in Node.js / Browser (zero external dependencies)
function decodeJwtPayload(token) {
  const base64Url = token.split('.')[1];
  const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
  const jsonPayload = decodeURIComponent(
    atob(base64)
      .split('')
      .map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
      .join('')
  );
  return JSON.parse(jsonPayload);
}

Python 3 (Standard Library)

# Decode JWT payload in Python 3 (zero external dependencies)
import base64
import json

def decode_jwt_payload(token: str) -> dict:
    payload_b64 = token.split('.')[1]
    # Add Base64 padding if needed
    payload_b64 += '=' * (-len(payload_b64) % 4)
    decoded_bytes = base64.urlsafe_b64decode(payload_b64)
    return json.loads(decoded_bytes.decode('utf-8'))

Frequently Asked Questions

Is it safe to paste sensitive or production JWTs into this tool?

Yes, 100%. Rocket Dev Tools executes entirely in your browser using client-side JavaScript. No tokens, headers, or payloads are ever sent to an external server, database, or analytics collector.

Can anyone read the payload of a JWT without the secret key?

Yes. JWTs are encoded with Base64URL, not encrypted (unless you are using JWE). The header and payload claims are readable by anyone who has the token string. The secret key is only required to verify the signature and ensure the token hasn't been tampered with.

What are the standard JWT registered claims?

Common standard claims include 'exp' (Expiration Time), 'iat' (Issued At), 'nbf' (Not Before), 'iss' (Issuer), 'sub' (Subject/User ID), and 'aud' (Audience).

What is the difference between HS256 and RS256?

HS256 is a symmetric algorithm using a single shared secret for both signing and verification. RS256 is an asymmetric algorithm using a private RSA key to sign the token and a public key to verify it, which allows public clients to verify tokens without knowing the signing key.

Related Developer Tools

JWT Generator ➔ Generate mock signed JWTs with custom claims Base64 Encoder / Decoder ➔ Encode & decode UTF-8 text and raw strings Hash & HMAC Generator ➔ Generate SHA-256, SHA-512, and HMAC signatures RSA Keypair Generator ➔ Generate PKCS#8 public and private keys