Free Developer Tool - runs 100% in your browser
JWT Decoder
Scroll down to learn more about this tool
Decode JSON Web Tokens online - without sending them anywhere
This JWT decoder splits a JSON Web Token into its three parts, Base64Url-decodes the header and payload, and pretty-prints the claims - instantly, as you type. Crucially, it is100% client-side: pasting a production token into a website that uploads it to a server is a security risk, and this tool never makes a network request with your input.
What's inside a JWT?
A JWT is three Base64Url-encoded segments joined by dots:
- Header - the signing algorithm (
alg, e.g. HS256 or RS256) and token type. - Payload - the claims: standard ones like
sub(subject),iss(issuer),exp(expiry),iat(issued at), plus any custom data. - Signature - a cryptographic signature over the first two parts.
The decoder also translates exp, iat and nbf timestamps into human-readable dates and tells you whether the token has expired.
Decoding is not verifying
Anyone can decode a JWT - the payload is only encoded, not encrypted. What makes a token trustworthy is itssignature, which must be verified server-side with the secret or public key. Never put sensitive data in a JWT payload, and never trust claims from a token whose signature you haven't checked. This tool is for inspection and debugging: reading claims, checking expiry, and diagnosing401 Unauthorized errors. Related: Base64 encoder/decoderand hash generator.