JWT Decoder
Decode and inspect JWT tokens instantly. View the header, payload, and signature.
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token format used to represent claims between two parties — most commonly for authentication and authorization in APIs, single sign-on (SSO), and OAuth flows. A JWT is made of three Base64Url-encoded parts separated by dots: a header (describing the signing algorithm), a payload (the actual claims, such as user ID, roles, and expiration), and a signature(which proves the token wasn't tampered with).
A JWT decodertakes a token and splits it back into its three parts, decoding the header and payload from Base64Url into readable JSON. This is different from verifying a JWT — decoding just reveals what's inside, while verification additionally checks the signature against a secret or public key to confirm the token is authentic and untampered.
Because the header and payload are only encoded, not encrypted, anyone can decode a JWT and read its contents without any key. Only the signature is cryptographically protected. This is why JWTs should never carry sensitive data like passwords in the payload — assume anything inside a JWT is publicly readable.
This page lets you decode a JWT online for free, directly in your browser. Paste any token and instantly view its header, payload, and signature, with standard timestamp claims converted to readable dates — nothing is uploaded or sent to a server.
Why Decode a JWT?
API Debugging
When an authenticated API request fails unexpectedly, decoding the JWT quickly confirms whether the expected claims, scopes, or expiration are actually present.
OAuth & SSO Integration
Implementing login with an identity provider (Auth0, Okta, Firebase, Cognito) often means inspecting an access or ID token to verify its structure matches what your backend expects.
Expiration Troubleshooting
A user getting logged out unexpectedly is often explained by checking the exp claim — decoding the token reveals exactly when it expires.
Security Review
Before trusting a third-party JWT, reviewing its payload confirms it doesn’t leak more information than intended, since the payload is readable by anyone without the secret key.
Example
Here's a sample JWT and the header and payload it decodes to.
Encoded tokeneyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Features
Decode
Split a JWT into its header, payload, and signature and view each part as readable JSON.
Timestamp Conversion
Standard claims like iat, exp, and nbf are automatically converted to human-readable dates.
Inspect Claims
Scan every claim in the payload at a glance — no need to manually Base64-decode anything.
100% Client-Side
Decoding happens entirely in your browser. Your token is never uploaded or sent to a server.