JWT Decoder
Decode and inspect JWT tokens instantly. View the header, payload, and signature.
Related Tools
Learn more about the JWT Decoder
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token format used to represent claims between two parties — most commonly for authentication and authorization in APIs, single sign-on (SSO), and OAuth flows. A JWT is made of three Base64Url-encoded parts separated by dots: a header (describing the signing algorithm), a payload (the actual claims, such as user ID, roles, and expiration), and a signature (which proves the token wasn't tampered with).
A JWT decoder takes a token and splits it back into its three parts, decoding the header and payload from Base64Url into readable JSON. This is different from verifying a JWT — decoding just reveals what's inside, while verification additionally checks the signature against a secret or public key to confirm the token is authentic and untampered.
Because the header and payload are only encoded, not encrypted, anyone can decode a JWT and read its contents without any key. Only the signature is cryptographically protected. This is why JWTs should never carry sensitive data like passwords in the payload — assume anything inside a JWT is publicly readable.
This page lets you decode a JWT online for free, directly in your browser. Paste any token and instantly view its header, payload, and signature, with standard timestamp claims converted to readable dates — nothing is uploaded or sent to a server.
Why Decode a JWT?
API Debugging
When an authenticated API request fails unexpectedly, decoding the JWT quickly confirms whether the expected claims, scopes, or expiration are actually present.
OAuth & SSO Integration
Implementing login with an identity provider (Auth0, Okta, Firebase, Cognito) often means inspecting an access or ID token to verify its structure matches what your backend expects.
Expiration Troubleshooting
A user getting logged out unexpectedly is often explained by checking the exp claim — decoding the token reveals exactly when it expires.
Security Review
Before trusting a third-party JWT, reviewing its payload confirms it doesn’t leak more information than intended, since the payload is readable by anyone without the secret key.
Example
Here's a sample JWT and the header and payload it decodes to.
Encoded tokeneyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Features
Decode
Split a JWT into its header, payload, and signature and view each part as readable JSON.
Timestamp Conversion
Standard claims like iat, exp, and nbf are automatically converted to human-readable dates.
Inspect Claims
Scan every claim in the payload at a glance — no need to manually Base64-decode anything.
100% Client-Side
Decoding happens entirely in your browser. Your token is never uploaded or sent to a server.
How to use
Paste your input in the left editor. The output appears automatically on the right. Use the toolbar buttons to copy, download, or transform the result.
- Paste or type your content in the input editor on the left.
- The formatted output is generated automatically.
- Use Copy, Download, or other actions from the output toolbar.
- Click the expand icon to view the output in fullscreen.
FAQ
Is this JWT decoder free?
Yes, the JWT decoder is completely free to use with no limits, signup, or account required.
Is it safe to paste my JWT here?
All decoding happens in your browser — your token is never sent to a server. However, avoid pasting production tokens in shared environments.
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token format used to represent claims between two parties, commonly for authentication and authorization. It has three parts: header, payload, and signature.
Does it verify the signature?
No. It decodes and displays the token contents (header and payload) but does not verify the signature, since that requires the secret key or public key used to sign it.
Why is my JWT payload readable without a secret key?
The header and payload of a JWT are only Base64Url-encoded, not encrypted, so anyone can decode and read them. Only the signature requires a secret to verify, which is why JWTs should never contain sensitive data.
What do the iat, exp, and nbf fields mean?
"iat" is the issued-at timestamp, "exp" is the expiration time, and "nbf" is the not-before time — all standard JWT claims used to control a token’s validity window. This tool automatically converts them to readable dates.