JWT Decoder
Decode JSON Web Tokens.
100% Client-Side
A diferencia de otras herramientas, Docuboxer decodifica y verifica tu JWT directamente en tu navegador usando la Web Crypto API.
Tu token (que a menudo contiene PII o es un token de sesión vivo) nunca cruza la red, protegiéndote de interceptaciones o logs en servidores de terceros.
Claims comunes
- iss (Issuer)
- El principal que emitió el JWT.
- sub (Subject)
- El sujeto principal del token (usualmente el ID del usuario).
- aud (Audience)
- Para quién o qué servicio está destinado este token.
- iat (Issued At)
- Timestamp de cuándo se creó el token.
How do you decode a JWT online without leaking it?
Docuboxer's JWT decoder splits a JSON Web Token into its three parts — header, payload and signature — and shows the decoded content as formatted JSON, entirely in your browser. Paste the token and instantly inspect the algorithm in the header, the claims in the payload (subject, roles, issuer, audience) and the expiry timestamp, which is the field behind most "invalid token" bugs. The tool can also check the token's signature. The privacy angle matters more with JWTs than with almost anything else you'd paste into a web tool: a live token is a bearer credential — whoever holds it can impersonate its owner. Here the token never leaves your device: no server, no logs, no retention, and the decoder keeps working offline once the page has loaded. Free, no signup. A useful detail: JWTs are Base64url-encoded, not encrypted — anyone can read them.
How to use JWT Decoder
- Paste your complete JWT (the three dot-separated parts) into the decode field.
- The tool automatically splits and decodes the Header and Payload, and verifies the token's signature.
- Read each section as formatted JSON and inspect the token's claims, expiry and permissions.
Common use cases
Debug authentication tokens during API development
Decode JWTs generated by your backend to verify that claims, roles, expiry and user data are correct before wiring authentication into your frontend.
Audit tokens from identity providers
Inspect JWTs issued by Auth0, Firebase, AWS Cognito or other providers to understand what information they carry and confirm they meet your application's security requirements.
Diagnose expired-token errors
When an API suddenly returns 401, decode the token and check the exp claim — a decoded timestamp answers in seconds what log-digging answers in minutes.
Verify roles and permissions in claims
Confirm that the scopes, roles and custom claims your authorization logic depends on are actually present in the token being issued.
Inspect tokens without pasting them into the cloud
A JWT is a bearer credential. Decoding it locally means it never reaches a third-party server, log or analytics pipeline.
Frequently asked questions
How do I decode a JWT token?
Paste the full token — three Base64url segments separated by dots — and the tool instantly shows the header and payload as readable JSON, plus the signature check. Free, no signup, and decoded entirely in your browser.
Is a JWT encrypted?
No — a standard JWT is signed, not encrypted. The header and payload are just Base64url-encoded JSON that anyone can decode. The signature prevents tampering, not reading. Never put secrets in a JWT payload.
Is it safe to paste my JWT into this tool?
Yes — all processing happens locally in your browser and the token is never sent to any server. Still, as good practice, avoid sharing production tokens that contain sensitive data.
Can this tool forge or modify a JWT?
No. It only decodes and displays the token's content. Modifying a JWT would require knowing the signing secret, and any alteration invalidates the token's cryptographic signature.
Why does my API reject a token that decodes fine?
Decoding only proves the token is well-formed. Rejections usually come from an expired exp claim, a wrong audience or issuer, or a signature that doesn't match the server's key — check those claims in the decoded payload first.
What are the three parts of a JWT?
Header (algorithm and token type), payload (the claims: subject, expiry, roles, custom data) and signature (a cryptographic seal over the first two parts). They travel Base64url-encoded, joined by dots.