DigiKitApp
🇹🇷 TRQuick Access

JWT Decoder - DigiKitApp

Decode and view a JWT token’s header and payload.

When should you use this?

Use this when you need to see the information inside a JWT (user ID, expiry) in a readable form, for instance while debugging an API issue.

When shouldn't you use this?

This tool only decodes, it doesn't verify the signature; to know whether a token is actually valid you need server-side verification, don't use the output for a security decision.

Step-by-step

  1. Copy the JWT from an API request, your browser's network tab or a log entry. Leave out the "Bearer" prefix from the Authorization header so only the token remains.
  2. Paste it into the JWT token field. Make sure all three dot-separated parts made it into the field.
  3. Click Run.
  4. Read the header and payload in the result area. The header shows the signing algorithm (alg), and the payload holds the claims about the user and the token's lifetime.

Example

A mobile app starts getting 401 errors from your API some time after the user logs in. Paste the token the app is sending and look for the exp claim in the payload. It is a Unix timestamp, the number of seconds since 1 January 1970. If it converts to a time in the past, the token has expired and the refresh flow is the likely culprit. If exp is still in the future, check whether aud and iss match what the server expects. A mismatch there produces the same 401 and is easy to miss.

How is a JWT structured?

A JSON Web Token (JWT) has three parts separated by dots: header, payload and signature. The header and payload are Base64URL-encoded JSON, so anyone can read them. The signature lets a server verify that the data was not altered. The exp (expiry), iat (issued at) and nbf (not before) claims in the payload are Unix timestamps in seconds.

Be careful when decoding a JWT

  • Decoding is not verifying: the tool does not confirm the signature or that the content is trustworthy.
  • Do not share real tokens from live systems; they act like access keys.
  • Do not store passwords or secrets in the payload; anyone can read it.
  • If exp is in the past the token has expired; also watch for clock differences.

Things to keep in mind

  • A JWT is encoded with Base64URL, not encrypted. Anyone holding the token can read the payload, so never put passwords or sensitive personal data in it.
  • A live token copied from production works like a session key until it expires. Think twice before pasting one into a chat or a bug report screenshot.
  • If the header says alg is none, the token carries no signature at all. Confirm separately that your server rejects such tokens.
  • The iat, nbf and exp claims are in seconds, not milliseconds. Forgetting to multiply by 1000 before passing them to a JavaScript Date is a classic bug.

Frequently asked questions

Is the code/data I enter stored anywhere?

No, nothing is sent to a server or stored; processing happens entirely in your browser.

Does it work with large inputs?

Yes, though performance may degrade with very large inputs (several MB or more).

Is this tool free?

Yes, it's completely free for core use and requires no account.