JWT Decoder

What is a JWT Decoder?

A JWT (JSON Web Token) decoder is a tool that splits and decodes a JWT string into its three constituent parts — the header, payload, and signature — revealing the algorithm used and the claims stored inside the token in plain, readable JSON.

How to Use the JWT Decoder

1. Paste your JWT token string into the input field above.
2. The tool automatically splits the token on the two dot separators.
3. The header section is Base64url-decoded and displayed as formatted JSON.
4. The payload section is Base64url-decoded to reveal all claims (sub, iat, exp, etc.).
5. The raw signature is shown separately — note that signature verification requires the secret key and is not performed here.
6. Use the Copy buttons to grab the header or payload JSON for further use.

Common Use Cases

• Debugging authentication issues by inspecting token claims during development.
• Checking token expiry (exp claim) to understand why a request is being rejected.
• Verifying the signing algorithm in the header matches what your server expects.
• Inspecting user roles and permissions encoded in the payload.
• Comparing tokens issued across different environments (dev, staging, prod).
• Understanding a third-party API's token structure when integrating OAuth flows.

Why Use an Online JWT Decoder?

Decoding a JWT manually involves Base64url-decoding each part and parsing the JSON — tedious and error-prone when done in a terminal. An online decoder does this instantly with a single paste, formats the output for readability, and highlights the structure. Because this tool runs entirely in your browser with no server requests, your token never leaves your machine, making it safe to use even with tokens containing sensitive user data.

Frequently Asked Questions

Is it safe to paste my JWT into this tool?

Yes. All decoding happens in your browser using JavaScript. No data is transmitted to any server, so your token remains completely private.

Can this tool verify the JWT signature?

No. Signature verification requires the secret key (HMAC) or the public key (RSA/ECDSA). This tool only decodes — it cannot confirm whether a token is authentic or tamper-free without the key.

Why does the payload show numbers for iat and exp?

The iat (issued at) and exp (expiration) claims are Unix timestamps — the number of seconds since January 1, 1970 UTC. You can convert them using any Unix timestamp converter to get a human-readable date.

Related Tools

Explore more free developer tools: Base64 Converter — encode and decode Base64 strings used inside JWT segments. JSON Formatter — pretty-print and validate the JSON you extract from JWT payloads. Hash Generator — generate HMAC and other cryptographic hashes for token signing experiments.