Developer Tools
Free Online JWT Decoder
Paste a JSON Web Token (JWT) below to decode its header and payload into readable JSON — entirely in your browser.
Note: this decodes the token only. It does not verify the signature.
How to use the jWT Decoder
- Paste a full JWT (three dot-separated parts) into the input box.
- Click 'Decode JWT'.
- View the decoded header and payload as formatted JSON.
- Remember: this only decodes the token; it does not verify the signature.
Example
Decoding a JWT payload often reveals fields like {"sub":"1234567890","name":"Alex","iat":1735689600} — the claims embedded in the token.
Why decode a JWT?
JWTs are used constantly in authentication systems, and their header and payload are just Base64Url-encoded JSON, not encrypted. Decoding them is essential for debugging login flows, inspecting claims, or checking token expiry.
Decoding only, not verification
This tool decodes the readable parts of a JWT but does not check its cryptographic signature. Never treat a decoded token as verified, and be cautious pasting tokens from production systems.
Frequently asked questions
No, it only decodes the header and payload for readability. Signature verification requires the corresponding secret or public key and isn't performed here.
No, standard JWTs are signed, not encrypted — anyone can decode the header and payload without a key, which is why sensitive data shouldn't be stored in them.
Decoding happens entirely in your browser and nothing is sent anywhere, but as a general practice avoid pasting tokens from production or sensitive systems into any web tool.
An error is shown if the pasted text isn't a valid three-part JWT or if a section isn't valid Base64Url-encoded JSON.