JWT Decoder
Decode a JSON Web Token's header and payload instantly in your browser and see the claims inside. This only decodes — it does not verify the signature, so never trust an unverified token's contents for authorization.
What Is a JWT?
A JWT (JSON Web Token) is a compact way to pass a set of claims — like a user ID, a role, or an expiration time — between two parties, often used for authentication and API access tokens. It's three Base64url-encoded segments joined by dots: header.payload.signature.
The header describes the token (typically the signing algorithm). The payload holds the actual claims, as JSON. The signature lets the token's issuer prove it wasn't tampered with — but only the issuer, holding the secret or private key, can create or check a valid one.
Why Decode a JWT?
The header and payload are Base64url-encoded, not encrypted — anyone can read them without a secret key. Decoding lets you inspect exactly what claims a token carries: who it's for, when it was issued, when it expires, and any custom fields an application added.
How This Tool Works
Paste a JWT into the box below and click Decode JWT. This tool splits the token into its three parts, Base64url-decodes the header and payload, and shows you the resulting JSON. It does not verify the signature — it can't, without the secret or public key — so treat the decoded contents as informational only, never as proof the token is genuine or unexpired. Everything runs in your browser; nothing is uploaded to any server.
Decoding a JWT vs. Verifying a JWT
| Feature | Decoding | Verifying |
|---|---|---|
| What it checks | Nothing — just reads the Base64url content | The signature, against a secret or public key |
| Requires a secret/key | No | Yes |
| Tells you the claims | Yes | Yes |
| Tells you if the token is genuine | No | Yes |
| Tells you if it's expired | You can read exp, but nothing enforces it | Yes, as part of validation |
| Safe to base an authorization decision on | No | Yes |
Decode a JWT When
- You're debugging what claims a token actually contains
- You're inspecting a token during development, not making a security decision based on it
Verify a JWT When
- Your application needs to trust the token's claims (authenticating a request, checking a role)
- You need to confirm the token hasn't been tampered with or expired
This tool only decodes. Verification always needs to happen in your backend, using your actual signing secret or public key — never in a browser tool like this one, and never based on the payload's contents alone.
Common Scenarios for Decoding a JWT
Debugging Why an API Call Is Being Rejected
If an API returns a 401 or claims your token is invalid, decoding it here shows you exactly what claims it actually carries — the right sub, the expected aud, or maybe an unexpectedly wrong value that explains the rejection.
Checking When a Token Expires
JWTs commonly include an exp (expiration) and iat (issued-at) claim, both stored as Unix timestamps. After decoding here, paste those numeric values into our Unix Timestamp Converter to see the actual expiration date and time.
Reviewing What Data an Auth Provider Puts in a Token
When integrating a third-party auth provider (Auth0, Firebase, Cognito, and similar), decoding a sample token shows you exactly what claims and custom fields it includes, so you know what's actually available to your application code.
Verifying Your Own Backend Is Issuing the Right Claims
While developing token-issuing code, decoding a freshly generated token confirms the payload matches what you intended — the right user ID, roles, and expiration — before you wire up anything that depends on it.
Teaching or Learning How JWTs Work
Because a JWT's header and payload are just Base64url-encoded JSON, decoding one is a fast, hands-on way to see that structure directly, without writing any code.
Other Ways to Decode a JWT
You can also decode a JWT using jwt.io, or a short script using your language's Base64 library — the header and payload are just Base64url-encoded JSON. FileCast is useful for a quick, one-off decode without pasting a token into a third-party site tied to a specific vendor.
Frequently Asked Questions
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser — nothing is sent to any server. That said, treat any real production token with the same care you'd give a password: if you're pasting one into a tool at all, prefer a test or expired token when possible.
Does this verify the signature?
No, and it can't — verifying a signature requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms) that only the token's issuer has. This tool only decodes the header and payload, which are readable by anyone without any key at all.
Does that mean the claims I see could be fake?
If the token wasn't verified, yes — anyone can construct a JWT-shaped string with any payload they like. Never make an authorization decision based on decoded-but-unverified claims. Signature verification always has to happen server-side, as part of your actual authentication logic.
What does the "alg" field in the header mean?
It names the signing algorithm the issuer claims to have used, like HS256 (HMAC-SHA256) or RS256 (RSA-SHA256). It's part of what a real verification step checks — a properly implemented verifier should never blindly trust this field either, since it's just as unverified as the rest of the token.
Why did I get an error saying the JWT couldn't be decoded?
Either the input isn't a JWT at all (it needs exactly three dot-separated parts), or one of the header/payload segments isn't valid Base64url-encoded JSON — often because the token was truncated or a character got altered when it was copied.