JWT Decoder
Decode a JWT's header and payload instantly in your browser — no signature verification.
Paste a JWT above to decode it.
How to use this tool
A JWT (JSON Web Token) is a compact, URL-safe way to represent a set of claims — like a user ID, roles, or an expiry time — signed by whoever issued it. It's made of three Base64URL-encoded, dot-separated parts: header.payload.signature. This tool decodes the header and payload back into readable JSON so you can inspect what a token actually contains — useful when debugging auth issues, checking what claims an API is sending, or confirming when a token expires.
For example, a token starting with eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... decodes to a header of { "alg": "HS256", "typ": "JWT" }, and its payload might decode to something like { "sub": "1234567890", "name": "John Doe" }.
Paste a JWT into the box below. The header and payload appear as pretty-printed JSON automatically, and if the payload has an exp claim, a status banner shows whether the token is still valid or has expired.
FAQ
Is this JWT decoder free to use?
Yes, this tool is completely free to use with no limits on how often you can use it.
Does my token get uploaded anywhere?
No. The token is decoded directly in your browser. It never leaves your computer or gets sent to a server.
Does this tool verify the signature?
No — this is a decoder, not a validator. It reads and pretty-prints the header and payload, which are only Base64URL-encoded (not encrypted), but it does not check the signature against a secret or public key. A token can be decoded here and still be invalid, expired-but-tampered-with, or forged. Never trust a JWT's claims without verifying its signature server-side using the correct key.
Why can anyone read the payload of a JWT?
Because a JWT's header and payload are only Base64URL-encoded, not encrypted — encoding just makes the JSON safe to put in a URL or header, it doesn't hide it. Anyone with the token can decode it exactly like this tool does. Never put secrets or sensitive data directly in a JWT payload; rely on the signature only to prove the token wasn't tampered with, not to keep its contents private.
Related Tools
JWT Generator
Build and sign a JWT from a custom header, payload, and secret using HS256.
Base64 Encode/Decode
Encode text to Base64 or decode Base64 back to text.
URL Encoder/Decoder
Encode text for URLs or decode URL-encoded text back to plain text.
HTML Entity Encoder/Decoder
Encode text to HTML entities or decode HTML entities back to plain text.