JWT Decoder
Decode the header and payload of a JWT in your browser to inspect claims and token structure without needing an account.
Your result will appear here.
JWT Decoder online
Decode a JSON Web Token's header and payload in your browser — read the claims inside a token you were issued, without sending it to anyone's server.
How to use this tool
- Paste the full token (the three base64url segments separated by dots) into the input box.
- Click Run Tool. The header and payload are decoded and shown as formatted JSON.
- Read the claims — remember the signature is not verified here; see the notes below.
Common uses
Debugging an authorization flow ("what does the API think I sent?"), checking a token's expiry and issuer claims while developing, inspecting tokens from your own systems in logs, and learning the JWT structure hands-on.
How it works
A JWT is three base64url segments joined by dots: header, payload, signature. This decoder base64url-decodes the first two and parses them as JSON — the header (algorithm and type) and the payload (the claims: sub, iss, exp and friends). The signature segment is ignored entirely: decoding is not verification. Nothing here proves the token is genuine, unmodified or unexpired — it only shows you what the token says.
Worked example
The classic example token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
decodes to header {"alg":"HS256","typ":"JWT"} and payload {"sub":"1234567890","name":"John Doe","iat":1516239022}. The iat is a Unix timestamp in seconds — 1516239022 is 18 January 2018 — which the Timestamp converter on this site will expand for you.
Privacy and browser processing
The token is decoded in your browser with JavaScript — it is never uploaded, which is the only safe way to inspect one.
Frequently asked questions
Does decoding verify the token?
No. Anyone can read a JWT — the payload is encoded, not encrypted. Verification (checking the signature against the issuer's key) must happen in your backend with the proper library; a decoded payload is a claim, not a proof.
Is it safe to paste a real token here?
The decoding happens locally and nothing is uploaded, which is the safer way to inspect one. Still treat tokens as credentials: a live token pasted anywhere is a token that can leak via screenshots and shoulder-surfing, so prefer expired or test tokens for demos.
Why does it say "Invalid JWT"?
The input did not split into at least two dot-separated segments, or the payload segment was not base64url-encoded JSON. Check that you copied the whole token, without spaces or line breaks introduced by an email client.
What are exp, iat and nbf?
Registered time claims, all in Unix seconds: exp is when the token expires, iat when it was issued, nbf when it becomes valid. Compare exp against the current time with the Timestamp converter to see if a token should still work.
My token has only two segments. Will it decode?
Yes — an unsigned (alg "none") token has an empty signature segment, and the decoder only needs header and payload. Treat such tokens with extra suspicion in production systems.