JWT Decoder
Paste a JWT token to decode its header and payload. No secret required — this only decodes, it doesn't verify.
Related Tools
How to Decode a JWT Token Online
JSON Web Tokens (JWTs) are base64-encoded and look opaque, but they're not encrypted — anyone can read the payload. This JWT debugger splits a token into its three parts (header, payload, signature), decodes the Base64, and shows you the claims in a readable format. Everything runs in your browser.
Use this when you need to check token expiration (exp claim), verify the issuer (iss), inspect user claims, or debug authentication issues. Paste in a JWT from an Authorization: Bearer header, a cookie, or your auth library's output, and you'll immediately see what's inside. JWTs are transmitted via HTTP headers — use our HTTP Header Analyzer to verify your Authorization and security headers are configured correctly.
The decoder shows the header (algorithm and token type), the payload (all claims including sub, iat, exp, and any custom claims), and the raw signature. Note that this tool decodes but does not verify signatures — signature verification requires the secret or public key, which you should never paste into a web tool.
Tips
- JWTs are encoded, not encrypted. Never put sensitive data (passwords, SSNs) in JWT claims.
- Check the
exp(expiration) andiat(issued at) timestamps — they're Unix epoch seconds, not milliseconds. - The
algfield in the header tells you which signing algorithm was used —RS256(RSA) andHS256(HMAC) are most common. - If the token has three dots, it's a JWS (signed). If it has five, it might be a JWE (encrypted) — this tool handles JWS only.