JWT Decoder

    Decode, verify, and debug JSON Web Tokens.

    Encoded Token
    Header
    Header data will appear here...
    Payload
    Payload data will appear here...
    Verify Signature
    HMACSHA256(
      base64UrlEncode(header) + "." +
      base64UrlEncode(payload),
      your-256-bit-secret
    )

    About JSON Web Tokens (JWT)

    A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe means of representing claims to be transferred between two parties. Defined by RFC 7519, JWTs have become the de facto standard for authentication and authorization in modern web applications, mobile apps, and APIs.

    Every JWT consists of three parts separated by dots (.), each part being a Base64URL-encoded string:

    • Header: Contains metadata about the token, including the signing algorithm (like HS256, RS256) and the token type (JWT).
    • Payload: Contains the claims - statements about the user and additional metadata. Standard claims include exp (expiration), iat (issued at), sub (subject/user ID), iss (issuer), and aud (audience).
    • Signature: Created by encoding the header and payload, then signing them with a secret key (for HMAC algorithms) or a private key (for RSA/ECDSA). This ensures the token hasn't been tampered with.

    How to Decode a JWT

    1. 1

      Get your JWT token

      Copy the complete JWT token from your application, API response, browser storage, or authentication header.

    2. 2

      Paste the token

      Paste the entire token (including all three parts separated by dots) into the input field.

    3. 3

      View decoded data

      The tool automatically splits and decodes the Header and Payload sections.

    Frequently Asked Questions

    A JWT is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three Base64-encoded parts separated by dots: a header (algorithm and token type), a payload (claims/data), and a signature (verification). JWTs are commonly used for authentication and authorization in web applications.

    With most online tools, no - your token would be sent to a server. However, this decoder runs entirely in your browser using JavaScript. Your token is never transmitted anywhere. It stays on your device, making it completely safe to decode even production tokens.

    Decoding simply extracts and displays the header and payload data (which are just Base64-encoded, not encrypted). Verification checks the signature to ensure the token hasn't been tampered with and was issued by a trusted source. This tool decodes only - verification requires the secret key or public key.

    JWTs are signed, not encrypted. The signature ensures integrity (the token wasn't modified), but the payload is readable by anyone. Never store sensitive data like passwords in JWT payloads. For sensitive data, use encrypted tokens (JWE) or store data server-side and use the JWT only as a reference.

    Related Tools

    JWT Decoder Comparison

    Compare with jwt.io

    JSON Viewer

    Format JSON data

    Base64 Converter

    Encode/decode Base64

    Timestamp Converter

    Convert Unix timestamps