JWT Decoder
Decode a JSON Web Token in the browser and inspect header and payload claims.
JWT Decoder
Decode header, payload, and signature. This page does not verify the signature; anyone can forge a JWT payload.
Sample is a harmless unsigned example (alg none). Not a real secret.
HEADER Algorithm & Token Type
PAYLOAD Data / Claims
SIGNATURE
What is a JWT decoder?
A JWT decoder is a tool that splits a JSON Web Token into header, payload, and signature and shows the claims (iss, exp, sub) as readable JSON. A JWT is three Base64-encoded parts separated by dots — header.payload.signature — used for authentication. This page decodes; it does not verify the signature against a secret.
JWTs are stateless — the server does not need to store session data. Instead, all the information needed to authorize a request is encoded directly in the token. Each request includes the JWT, and the server verifies it by checking the signature against its secret key.
How to Use the JWT Decoder
Paste your JWT
Paste the JWT string into the input field. It should be three dot-separated Base64 strings: header.payload.signature.
Inspect the decoded output
The tool instantly decodes and displays the header and payload as formatted JSON. Review user ID, roles, expiry (exp), issued-at (iat), and custom claims.
Check expiry and timestamps
The exp and iat fields are Unix timestamps. The tool converts them to human-readable dates so you can see when the token was issued and when it expires.
Debug or document
Use the decoded output to debug authentication flows, verify claim structure, or document what your API tokens expose for security reviews.
The Anatomy of a JWT
A JWT is a string consisting of three parts separated by dots (.):
- 1. Header Contains the cryptographic algorithm used to secure the token (e.g., HMAC SHA256 or RSA) and the type of token (JWT).
- 2. Payload
Contains the "claims" — statements about an entity (typically, the user) and additional data like the token's expiration date (
exp). They are readable by anyone, so highly confidential information should never go here. - 3. Signature Created by hashing the encoded header, the encoded payload, and a secret server-side key. The signature ensures the token has not been tampered with in transit.
Who Is This For?
- ▸ Developers debugging authentication flows who want to inspect what claims a JWT contains without writing a script to decode it manually.
- ▸ Backend engineers verifying token structure during API development — confirm the payload contains the expected fields before shipping an auth endpoint.
- ▸ Security reviewers auditing what data a token exposes — verify that sensitive information like passwords or PII is not accidentally included in the JWT payload.
Key Benefits
- ✓ Runs in your browser — Your token stays in the browser.
- ✓ Free with no subscription — no account, no paywall, no usage limits.
- ✓ No account required — open the page and start decoding immediately.
- ✓ Human-readable timestamps — Unix timestamps in exp and iat fields are automatically converted to readable dates.
Common JWT Mistakes
- Trusting claims without verifying the signature: Decoding a JWT reads the payload — but it does not prove the token is authentic. Always verify the signature server-side using your secret key before trusting any claim.
- Storing JWTs in localStorage: localStorage is accessible to any JavaScript on the page, making it vulnerable to XSS attacks. Store sensitive JWTs in
httpOnlycookies instead, which JavaScript cannot read. - Not checking the exp claim: A JWT with a valid signature but a past
exptimestamp should be rejected. Many implementations skip expiry validation, accepting tokens that should have been invalidated long ago. - Putting sensitive data in the payload: The JWT payload is Base64-encoded, not encrypted. Anyone who intercepts the token can decode and read every claim. Never put passwords, credit card numbers, or PII in the payload.
The JWT payload uses Base64Url encoding — the Base64 encoder/decoder can decode individual segments if you need to inspect them manually. For hashing passwords that you might store as claims, use the bcrypt generator instead of storing them in plaintext.
Further reading: RFC 7519 — JSON Web Token (IETF)
Common Use Cases
A user reports they are being logged out unexpectedly. Decode the JWT from the browser's local storage to check the exp claim and confirm whether the token is expiring sooner than expected.
You are integrating a third-party authentication provider and need to confirm which claims are included in the token — user ID, email, roles, and tenant ID. Paste the token and inspect the payload to map each field before writing your authorization logic.
You are doing a security review and need to verify that the JWT payload does not expose sensitive data. Decode several tokens from your staging environment and confirm no PII or credentials are included in the claims.
Frequently Asked Questions
What is a JWT?
A JWT (JSON Web Token) is a compact, self-contained token format used for authentication and authorization. It consists of three Base64-encoded parts separated by dots — header.payload.signature. The header describes the signing algorithm, the payload contains claims like user ID and expiry time, and the signature verifies the token has not been tampered with.
Is this tool free?
Yes. This JWT Decoder is free to use now — ads are not live yet — with no account required. The decoder runs entirely in your browser. Tool inputs stay in your browser. The site uses aggregate Google Analytics.
Is it safe to decode a JWT in the browser?
Decoding — reading the payload — is always safe to do. A JWT's payload is not encrypted, only Base64-encoded, so the contents are readable by anyone who has the token. That said, never paste a production token from a high-security system into an online tool you do not trust.
What is the difference between JWT and session cookies?
JWT is stateless — the server does not need to store anything; all the information is contained in the token itself. Session cookies require server-side session storage — the server stores session data and the cookie just holds a session ID. JWT is common in APIs and microservices. Session cookies are more common in traditional server-rendered web applications.
Does decoding a JWT validate its signature?
No. Decoding only translates the Base64-encoded string back into readable JSON — it does not verify authenticity. Verifying the signature requires the private secret key, which is kept on your authentication server. This tool shows you what the token contains; it cannot tell you whether the token is valid or authentic.
Is it safe to paste my production JWT here?
Yes. Your token stays in the browser.
This tool is provided for informational and educational purposes only. Results are not a substitute for professional advice.
Free Tools Alert
Get new tools, templates, and calculators in your inbox. No fake subscriber counts.
No spam. One-click unsubscribe.