JWT Decoder & Debugger

What is a JWT?

A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe way to represent claims between two parties, defined in RFC 7519. JWTs are widely used in OAuth 2.0 and OpenID Connect as access tokens and ID tokens. An ID token proves authentication happened and carries identity claims for the client application; an access token authorizes calls to an API and may be opaque or a JWT, and is meant for the API, not the client. To understand the format in depth, see What is a JWT token and how does it work in modern web apps.

How do I decode a JWT?

Paste the token into the decoder above. The tool splits it on its dots into header, payload and signature, base64url-decodes the header and payload, and parses them as JSON.

Decoding vs. verifying a JWT

Decoding just reveals the claims inside a token. It proves nothing. Verifying checks the signature against the issuer's public key (or a shared secret for HMAC algorithms), proving the token hasn't been tampered with and really was issued by the claimed issuer. Always verify a token before trusting any claim inside it. Use the "Verify signature" panel above to do this. A signature usually fails to verify because of the wrong key (check that the header's kid matches a key in your JWKS; the JWKS explorer can find it for you), the wrong algorithm, a token modified after signing, or an accidentally trimmed/prefixed value, not because the token itself is malformed.

JWT structure: header, payload, signature

A JWT is three base64url-encoded segments joined by dots (any one of them can be decoded on its own with the Base64URL decoder):

• Header: the algorithm (alg) and token type.
• Payload: the claims, e.g. iss, sub, exp (expiration, a Unix timestamp in seconds; relying parties must reject a token whose exp has passed even if the signature is valid).
• Signature: proves the header and payload weren't changed, computed over them with the issuer's key.

Decoding JWTs in .NET

In .NET, you can decode (and verify) JWTs with Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler:

using Microsoft.IdentityModel.JsonWebTokens;

var handler = new JsonWebTokenHandler();
var jwt = handler.ReadJsonWebToken(rawToken);

Console.WriteLine(jwt.Issuer);
Console.WriteLine(jwt.GetClaim("sub").Value);
Console.WriteLine(jwt.ValidTo); // exp claim as DateTime

To validate the token (signature, issuer, audience, lifetime), call handler.ValidateTokenAsync with a TokenValidationParameters configured with the issuer's signing keys. See token handling in IdentityServer for a complete example.