JWT Decoder: How to Read and Debug JSON Web Tokens
TL;DR
Learn how to decode JWTs, understand their structure, and debug authentication issues. Decode JSON Web Tokens instantly with a free online JWT decoder tool.
If you've worked with APIs, login systems, or any kind of web authentication, you've probably encountered a JWT. It's that long, cryptic string that gets passed around in headers and cookies. It looks unreadable, but it's not. A jwt decoder can turn that string into plain JSON in seconds.
This guide explains what JWTs are, how they're structured, and how to decode them. If you need to decode jwt tokens right now, the Morphkit JWT Decoder does it instantly in your browser.
What Is a JWT?
JWT stands for JSON Web Token. It's a compact, URL-safe way to pass information between two systems. Most commonly used for authentication. When you log in, the server creates a JWT containing your identity and permissions.
A JWT is not a random string. It's structured data, encoded so it can travel safely through URLs and HTTP headers. Anyone with a decoder can read what's inside.
JWT Structure: Three Parts
Every JWT has three parts separated by dots: header.payload.signature
Header
Tells the receiving system how the token was signed. Contains alg (signing algorithm) and typ (token type).
Payload
Where the actual data lives. Contains "claims" - key-value pairs describing the user or session. Can include standard claims like sub, exp, iat, and custom ones like role or email.
Signature
Created by hashing the header, payload, and a secret key. Used to verify the token hasn't been tampered with. Can't be decoded into readable JSON.
Why You'd Need a JWT Decoder
- Debugging login failures - check if role and user ID are correct
- Checking expiration - see the
expclaim - Verifying claims after auth server changes
- Understanding third-party API responses
- Comparing tokens between environments
How to Decode a JWT with Morphkit
- Copy the full JWT string
- Paste it into the Morphkit JWT Decoder
- See the decoded header, payload, and signature instantly
Your token never leaves your machine. If you need to inspect the JSON more closely, copy it to the JSON Formatter. For understanding Base64 encoding, use the Base64 Encoder/Decoder.
Common JWT Claims
| Claim | Name | What it means |
|---|---|---|
sub |
Subject | Who the token is about (user ID) |
exp |
Expiration Time | When the token expires (Unix timestamp) |
iat |
Issued At | When the token was created |
iss |
Issuer | Who created the token |
aud |
Audience | Who the token is intended for |
nbf |
Not Before | Token isn't valid before this time |
JWTs and Security
JWTs are encoded, not encrypted. Anyone can read the payload. The signature only verifies that nobody changed the contents. Never put passwords, credit card numbers, or sensitive information in a JWT payload.
Common JWT Mistakes
- Storing secrets in the payload
- Not validating the signature
- Ignoring expiration
- Using weak signing secrets
- Making tokens too large
Try the JWT Decoder now. It's free and requires no signup.