🪙 JWT Decoder
Decode JSON Web Tokens to inspect their header and payload. Note: this tool only decodes — it does not verify signatures.
⚠️ This tool only decodes — it does not verify signatures. Never share private JWTs.
Related Tools
How to Use the JWT Decoder
The JWT Decoder lets you instantly inspect the contents of any JSON Web Token (JWT) — no backend, no libraries to install, completely in your browser. Paste a JWT into the input field. A standard JWT has three Base64URL-encoded parts separated by dots: the header, the payload, and the signature. Click Decode (or just start typing) to see the decoded header and payload side by side as formatted JSON.
The header typically contains the algorithm and token type (e.g., {"alg":"HS256","typ":"JWT"}). The payload contains the claims — the actual data, such as the user ID, email, expiry time (exp), and issued-at time (iat). This tool does not verify the signature — it only decodes the visible parts. This means you can inspect any JWT without knowing the secret. For this reason, never include sensitive secrets in a JWT payload. Use this tool to debug authentication issues, inspect token expiry, verify claim values, or understand third-party tokens. Never paste production tokens into external tools.
Frequently Asked Questions
What is a JWT (JSON Web Token)?
›
A JWT (JSON Web Token) is a compact, URL-safe string used to securely transmit information between parties as a JSON object. It is commonly used for authentication: after a user logs in, the server issues a JWT that the client includes in subsequent requests (usually in the Authorization: Bearer header). The server can verify the JWT's signature to confirm the token is authentic and has not been tampered with.
What are the three parts of a JWT?
›
A JWT consists of three Base64URL-encoded parts separated by dots (header.payload.signature). The header contains the token type and signing algorithm (e.g., HS256 or RS256). The payload contains claims — key-value pairs with data like user ID, email, and expiry time. The signature is a cryptographic hash of the header and payload that the server uses to verify the token has not been modified.
Is it safe to decode a JWT without verifying the signature?
›
Decoding (reading) a JWT without verifying the signature is fine for inspection purposes. However, never trust the data inside a JWT without verifying its signature first — a malicious actor can forge a JWT with arbitrary claims if your server accepts unverified tokens. Always verify JWTs on the server side using the correct signing key.
What are common JWT claims?
›
Standard JWT claims include: iss (issuer), sub (subject — usually the user ID), aud (audience), exp (expiration time as Unix timestamp), iat (issued at), and nbf (not before). Custom claims can be anything, such as email, roles, or permissions. The exp claim is critical — always check it to ensure the token has not expired.