Three base64url-encoded parts separated by dots: a header (algorithm and token type), a payload (the actual claims - user ID, expiration, roles, etc.), and a signature (verifies the token hasn't been altered, using a secret only the issuer knows).

JWT Decoder - Free Online, No Signup

JWT Token

This tool only decodes the JWT. It does not verify the signature. Never paste sensitive production tokens into online tools.

How do you decode a JWT?

A JWT has three dot-separated parts - header, payload, and signature - and the first two are Base64URL-encoded, not encrypted. Decoding reveals the claims in plain text. Anyone holding the token can read its payload, so never put secrets in a JWT.

Runs in your browser. Your files and text never leave your device - nothing is uploaded.

Why use JWT Decoder?

A JWT's header and payload are only base64url-encoded, not encrypted - anyone with the token can read the claims inside it without needing a secret key, which is exactly what this decoder does. That's worth remembering: a JWT is not a safe place to put sensitive data, since anyone who intercepts it can decode the payload just as easily as this tool does. Decoding runs entirely in your browser, so no token gets sent to a server in the process - useful for debugging expired or malformed tokens during development without routing anything through a third party. What decoding doesn't do is verify the signature; that check requires the issuer's secret or public key and confirms the token wasn't tampered with, which is a separate step from reading what's inside it.

Key benefits

Decodes entirely in your browser, token never sent to a server
Instant, readable JSON output
Useful for debugging auth issues
Free, no account required

Features

Header and payload decoding
Claim-by-claim readable display
No signature verification - decoding only, keeps it purely client-side

Popular use cases

Debugging why an API request is being rejected due to an expired or malformed token
Inspecting what claims a JWT actually contains during development
Checking a token's issuer, audience, or expiration without backend logging
Learning how JWTs are structured

How to use JWT Decoder

1
Paste your JWT
The full token string (header.payload.signature).
2
View the decoded parts
Header and payload shown as readable JSON.
3
Inspect claims
Check expiration, issuer, subject, and other claims.

Frequently asked questions

Is it safe to paste my JWT into this tool?

Does this verify the token's signature?

What's inside a JWT?

What do the standard claims mean?

Why is my token rejected even though it has not expired?

What is the alg field in the header?

Can I edit the payload and re-use the token?

Reviewed by Raja Jahangir · Last reviewed: September 2026

How do you decode a JWT?

Related tools