JWT Decoder

About the JWT Decoder

JSON Web Tokens (JWT) are a compact, URL-safe method for transmitting claims between parties. They're widely used for authentication and authorization in modern web applications. Our JWT Decoder lets you decode the header and payload of any JWT token, displaying them as formatted JSON for easy inspection. All decoding occurs locally in your browser — your tokens are never sent to any server, maintaining complete security.

What Is JWT Decoder?

A JSON Web Token (defined in RFC 7519) is a string with three Base64URL-encoded parts separated by dots: header.payload.signature. The header describes the token type and the algorithm used to sign it (for example HS256 or RS256). The payload contains claims — statements about the subject, such as the user ID ('sub'), issued-at time ('iat'), expiration ('exp'), issuer ('iss'), and any custom fields your application needs. The signature is produced by signing the encoded header and payload with a secret or private key, which lets the receiving server verify that the token has not been tampered with. JWTs are stateless: the server does not need to look up a session, because all the information needed to authorize a request travels inside the token. The critical security caveat is that JWTs are encoded, not encrypted — anyone who obtains the token can read the payload. This tool decodes the header and payload for inspection; it does not verify the signature.

How to Use

1. Paste your JWT token into the input field above.
2. Click 'Decode' to parse the token.
3. View the decoded header (algorithm, token type) in the first code block.
4. View the decoded payload (claims, user data, expiration) in the second code block.
5. Verify the token structure: a valid JWT has three parts separated by dots (header.payload.signature).

Common Use Cases

• Debugging authentication failures by inspecting claims and expiry
• Verifying that expected roles or scopes are present in a token
• Checking the algorithm and key ID in the header during key rotation
• Learning how JWTs are structured while implementing login flows
• Confirming a token's expiration before sending a refresh request

Examples

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiZXhwIjoxNzAwMDAwMDAwfQ.abc123

Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "1234567890", "name": "Alice", "exp": 1700000000 }

Tips & Best Practices

• JWTs are Base64URL-encoded, not encrypted — the payload can be read by anyone with the token.
• The signature verifies the token hasn't been tampered with but this tool does not verify signatures.
• Check the 'exp' claim in the payload to see if the token has expired.
• Never paste production JWT tokens into online tools that send data to a server — ours is client-side only.

Frequently Asked Questions