JWT Decoder
Decode the header and payload of a JSON Web Token.
HEADER
{
"alg": "HS256",
"typ": "JWT"
}
PAYLOAD
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Paste a JWT to decode its header and payload into readable JSON — entirely in your browser. It does not verify the signature; it just reveals what’s inside the token. Nothing is uploaded.
Formula / method
Examples
header + payload as JSON
flagged as invalid
What gets decoded
A JSON Web Token is three Base64url-encoded parts joined by dots: a header, a payload and a signature. This tool splits the token and decodes the header and payload back into readable JSON, so you can inspect the claims inside, such as the subject, the issuer, and the expiry time. The header typically names the signing algorithm, while the payload carries the actual data.
Decoding is not the same as verifying. This tool shows you what a token contains, but it does not check the signature against a secret or key, which is what a server does to confirm the token is authentic and untampered.
An important security point
Base64url is an encoding, not encryption. Anyone who holds a JWT can read its payload with a tool like this one, so never place passwords, secret keys or sensitive personal data in a token's claims. Treat the payload as public information.
JWTs commonly express times as Unix timestamps in the 'exp' and 'iat' fields; to turn those numbers into a readable date, use the Unix Timestamp Converter. For decoding a plain Base64 string that is not a token, reach for the Base64 tool instead.
Where it's used
- Debugging authentication in an API or web app
- Inspecting token claims such as expiry, issuer and subject
- Checking why a session token is being rejected
- Confirming which user a token represents
- Learning the header/payload/signature structure of a JWT
Real-world examples
- Paste an HS256 token to read its header (alg, typ) and payload (sub, name, iat)
- Check a token's 'exp' claim to see whether it has already expired
- Confirm the 'iss' field matches the expected authentication server
- A string without two dots is flagged as not a valid JWT
A bit of history
The JSON Web Token format was standardised as RFC 7519, published by the IETF in May 2015 (authors Michael Jones, John Bradley and Nat Sakimura).
Did you know?
A JWT payload is only Base64url-encoded, not encrypted — anyone holding the token can read it — which is why secrets and passwords should never be placed in its claims.
FAQ
Does it check if the token is valid?
No — it only decodes and displays the contents. Verifying the signature needs the secret/key, which stays on your server. Never paste production secrets anywhere.