JWT Decoder

JWT Decoder is a free online tool that decodes and inspects JSON Web Tokens without requiring a secret key. Paste any JWT and the tool instantly splits it into its three parts — header, payload, and signature — and displays the decoded header and payload as readable, formatted JSON. Expiry and issued-at timestamps are automatically converted to human-readable dates. Perfect for debugging authentication flows, inspecting token claims, and understanding what a JWT contains.

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe string. A JWT consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. The header specifies the token type and the signing algorithm — commonly HS256 (HMAC-SHA256) or RS256 (RSA-SHA256). The payload contains claims: statements about the entity (typically the user) and additional metadata. The signature is computed by the server using a secret key and ensures the token has not been tampered with since it was issued.

The header and payload of a JWT are Base64URL-encoded, not encrypted. Anyone who possesses the token string can decode and read the header and payload — no secret key required. This is intentional: JWTs are designed to be readable (for performance and scalability in stateless authentication) while being tamper-proof (the signature prevents modification). Sensitive information — passwords, payment details, personal data — should never be placed in a JWT payload unless the token is also encrypted using JWE (JSON Web Encryption). Our decoder reads the header and payload freely. The signature is displayed as-is and can only be cryptographically verified with the issuing server's key.

JWT claims are the key-value pairs in the payload. Standard registered claims defined by RFC 7519 include: iss (issuer), sub (subject — typically a user ID), aud (audience — who the token is for), exp (expiration time as a Unix timestamp), nbf (not before — earliest valid time), iat (issued at — creation time), and jti (JWT ID — unique identifier). Our decoder displays exp, nbf, and iat as both Unix timestamps and human-readable date strings, so you can immediately see whether a token has expired or is not yet valid.

Authentication debugging is the primary use case for a JWT decoder. When a frontend application receives 401 Unauthorized errors on authenticated API requests, decoding the JWT being sent reveals immediately whether the token has expired, contains the wrong audience claim, is missing required permissions, or has an incorrect subject. This is faster than adding console.log statements throughout authentication code. Backend developers debugging JWT middleware validate the claims being presented. Security engineers audit what data is included in tokens to verify that sensitive information is not inadvertently exposed.

JWT Decoder is a read-only inspection tool — it only decodes and displays token content. It does not validate the signature, generate tokens, or verify token authenticity. Signature verification requires the secret key (for HMAC algorithms like HS256) or public key (for RSA/ECDSA algorithms like RS256/ES256) that only the issuing server holds. For signature verification, use your application's authentication library. Use this decoder purely to inspect the readable content of a token and diagnose claim-related issues.

JWT Decoder works entirely in your browser. The tool splits the JWT string on the dot separator, Base64URL-decodes the header and payload segments using JavaScript's atob() with padding normalisation, parses the resulting JSON, and pretty-prints both sections. Timestamp fields are converted to human-readable date strings using JavaScript's Date API. No token data is ever sent to any server — paste confidently without concern about exposing sensitive authentication data.