Why do I see garbled characters?

The token might not be UTF - 8 JSON, or it may not be a JWT.

JWT Decoder - Decode JWT Token Online

Decoding happens locally in your browser. Your token is never sent to our servers.

JWTs often look like opaque strings, but debugging auth issues usually requires quickly inspecting header/payload claims (exp, iat, scopes, user info).

Decode JWT header and payload instantly. No verification, no server upload. Works in your browser.

Show detailed guide & explanations▼

Why you may need this tool

JWTs are widely used for authentication and authorization, but the raw token string is difficult to reason about. When requests fail, you often need to check expiration (`exp`), issued - at (`iat`), audience, issuer, and role/scope claims to understand whether the issue is a token problem or a server - side rule. Decoding the header and payload into readable JSON helps you debug with evidence instead of assumptions. It is important to remember that decoding is not the same as verifying a signature.

How to use

Paste the JWT, then review header and payload claims such as exp/iat/nbf, roles, and audience.

Paste your JWT token
View decoded header and payload
Copy JSON or inspect standard claims (exp/iat/nbf)

Examples

Confirming whether a token is expired

If exp is in the past, requests can fail even when the server logic is correct. Decoding lets you confirm the expiration and focus on refresh or issuance flow.

Checking roles/scopes when authorization fails

A “forbidden” response often comes from missing role/scope claims. Inspecting the payload helps you verify whether the token includes the expected permissions.

Benefits & differentiators

Fast inspection helps you narrow down the failure mode: expired token, missing claims, wrong environment, or incorrect roles. This reduces time spent chasing unrelated server logic. Decoded claims are also easier to compare across environments (dev/staging/production) when you need to verify that issuance settings are consistent.

Who this is for

Recommended if you: - debug login/session issues involving JWTs - verify claim values like exp, aud, iss, role, or scope - compare tokens across environments - want quick visibility into token structure without manual decoding