JWT Decoder
Decode a JSON Web Token's header and payload to inspect its claims.
JSON Web Tokens (JWTs) are the standard way modern applications pass authentication and authorization data between a client and a server: a compact, three-part string containing a header, a payload of claims (user ID, roles, expiration time), and a cryptographic signature. When something's wrong with a login flow or an API request is being rejected unexpectedly, the fastest way to debug it is often to decode the token and look directly at what claims it actually contains.
This tool decodes the header and payload segments of any JWT — both of which are just Base64URL-encoded JSON, not encrypted — and displays them as readable, formatted JSON. It does not verify the signature, since that requires the issuer's secret key or public key, which you'd never want to paste into a third-party website; this is purely a decoding and inspection tool, not a validator.
Because the header and payload of a JWT are only encoded (not encrypted), anyone who has a copy of the token can read its contents exactly as this tool does — never put genuinely secret information directly in a JWT payload.
How to use JWT Decoder
- 1
Paste your JWT
Paste the full token (three parts separated by dots) into the input box.
- 2
Review the header
Check the algorithm (alg) and token type (typ) declared in the header.
- 3
Review the payload
Inspect the claims — expiration (exp), issued-at (iat), subject (sub), and any custom claims your application added.
Features
- Decodes both header and payload instantly
- Clear error messages for malformed tokens
- Runs entirely client-side — your token is never sent anywhere
- Pretty-printed JSON output for easy reading
Frequently asked questions
Common mistakes to avoid
- Assuming a JWT is encrypted just because it looks like an unreadable string — it's only encoded and easily decoded by anyone.
- Storing sensitive data directly in JWT claims, forgetting that anyone holding the token can read it.
- Not checking the exp (expiration) claim when debugging authentication issues — an expired token is one of the most common causes of unexpected 401 errors.
Get new tools in your inbox
One email a month with new tools, guides, and updates. No spam, unsubscribe anytime.