JWT Decoder

The JWT Decoder lets you inspect the contents of JSON Web Tokens (JWTs) directly in your browser. Simply paste a JWT to instantly decode its header and payload into a readable format, making it easier to understand token data during development and debugging.

The tool performs decoding locally in your browser, helping you inspect token contents without sending them to an external server.

Important: This tool only decodes JWTs. It does not verify the token's signature, authenticity, or validity.

Why Use a JWT Decoder?

JSON Web Tokens are widely used for authentication and authorisation in modern web applications and APIs. Because JWTs are Base64URL encoded, their contents aren't immediately readable.

A JWT Decoder converts the encoded token into a structured format, allowing developers to inspect claims, headers, and other token information while troubleshooting applications or testing authentication workflows.

Features

• Decode JWT headers and payloads instantly
• Display decoded JSON in a readable format
• Process tokens locally in your browser
• Inspect standard and custom JWT claims
• Fast browser-based decoding
• Simple and easy-to-use interface
• Works on desktop and mobile devices
• No downloads or registration required

How To Use the JWT Decoder

1. Paste your JWT into the editor.
2. Click Decode.
3. View the decoded header and payload.
4. Review the claims and token information.
5. Copy the decoded data if needed.

Decoding Examples

Decode a JWT

Paste a complete JSON Web Token into the decoder to view its contents.

The decoded result typically includes:

• Header
• Payload
• Claims

This makes it easier to inspect token information during development.

Inspect the Header

The JWT header contains information about how the token was created.

Common header fields include:

• Token type (typ)
• Signing algorithm (alg)
• Key identifier (kid) (when present)

Inspecting the header can help confirm which signing algorithm was used.

View the Payload

The payload contains the token's claims.

Common claims include:

• Subject (sub)
• Issuer (iss)
• Audience (aud)
• Expiration time (exp)
• Issued at (iat)
• Not before (nbf)
• JWT ID (jti)

Applications may also include custom claims depending on their authentication system.

Troubleshoot Authentication

A decoded JWT can help identify issues such as:

• Incorrect claim values
• Missing fields
• Unexpected expiration times
• Invalid audiences
• Development and testing mistakes

Remember that decoding alone does not confirm whether a token is valid or trusted.

Learn JWT Structure

A standard JWT consists of three sections separated by periods (.):

• Header
• Payload
• Signature

The decoder displays the readable contents of the header and payload but does not validate the signature.

Common Uses

The JWT Decoder is useful for:

• API development
• Authentication testing
• Web development
• Software debugging
• Identity systems
• OAuth and OpenID Connect development
• Inspecting JWT claims
• Learning JWT structure
• Troubleshooting authentication workflows

Understanding JWTs

A JSON Web Token (JWT) is a compact format used to securely transmit information between systems. JWTs are commonly used for authentication and authorisation in web applications and APIs.

A JWT contains three parts:

• Header – Information about the token type and signing algorithm.
• Payload – Claims containing information about the user or application.
• Signature – Used to verify that the token has not been altered.

This decoder displays the header and payload for inspection only. It does not verify whether the signature is valid or whether the token should be trusted.

Tips for Better Results

• Paste the complete JWT, including all three sections.
• Review both the header and payload when troubleshooting authentication issues.
• Check expiration (exp) and issued-at (iat) claims during testing.
• Never assume a decoded token is valid simply because it can be read.
• Avoid sharing production tokens containing sensitive information.

Frequently Asked Questions

What does the JWT Decoder do?

It decodes the header and payload of a JSON Web Token, allowing you to inspect its contents in a readable format.

Does the JWT Decoder verify signatures?

No. The tool only decodes the token. It does not verify the signature, authenticity, or integrity of the JWT.

Is decoding a JWT the same as validating it?

No. Decoding simply makes the token readable. Validation requires verifying the signature, checking expiration, and confirming that the token was issued by a trusted source.

What information can I see?

You can view the decoded header, payload, standard JWT claims, and any custom claims included in the token.

Is my JWT uploaded to a server?

No. The JWT is decoded locally within your browser and is not uploaded or stored.

Should I paste production tokens into online tools?

Avoid sharing production tokens that contain sensitive information. When working with live systems, always follow your organisation's security policies.

Is the JWT Decoder free?

Yes. You can decode JWTs online for free without creating an account or downloading software.