JWT Decoder
The JWT Decoder splits any JSON Web Token into its three Base64URL-encoded segments and presents the header and payload as formatted, human-readable JSON. Paste a token and the decoded output appears instantly, entirely in your browser.
What This Tool Does
A JWT is a compact string of three parts separated by dots: header, payload and signature. This tool reverses the Base64URL encoding of the first two parts and pretty-prints the JSON inside them, so you can see exactly which algorithm the token uses and which claims it carries. The signature segment is displayed as-is because it is binary data, not JSON.
How to Use
- Paste your JWT into the input field — decoding starts automatically.
- Review the decoded header to see the algorithm (alg) and token type (typ).
- Review the decoded payload to inspect claims such as sub, iss, aud, iat and exp.
- Use Copy or Download to save the decoded output, or Sample Data to load an example token.
- Use Reset to clear the editor before decoding another token.
Key Features
- Instant decoding of the JWT header and payload as formatted JSON
- Clear separation of header, payload and signature segments
- Helpful error messages for malformed or incomplete tokens
- Sample token, file upload, copy and download actions
- Horizontal or vertical editor layouts plus a fullscreen mode
- 100% client-side processing — tokens never leave your device
Common Use Cases
- Debugging login and authentication flows during development
- Reading the claims an identity provider placed in an access or ID token
- Confirming which signing algorithm a token declares
- Learning how the three JWT segments fit together
- Quickly checking a token received from an API while integrating it
Decoding Is Not Verification
Decoding only reverses Base64URL encoding — it requires no key and proves nothing about who issued the token or whether it was modified. A decoded payload should be treated as untrusted input until the signature has been verified with the correct secret or public key.
Because the payload is encoded rather than encrypted, anyone holding the token can read it. Never store passwords, keys or other secrets inside JWT claims.
Frequently Asked Questions
Does decoding a JWT verify its signature?
No. Decoding only converts the Base64URL segments into readable JSON. To confirm a token is authentic and unmodified, use the JWT Signature Verifier with the correct secret or key.
Is it safe to paste my token here?
All decoding happens locally in your browser with JavaScript. Your token is never sent to a server or stored. As a general precaution, avoid pasting production tokens on shared computers.
Why do I get an "invalid token" error?
A JWT must contain exactly three Base64URL segments separated by dots. Extra whitespace, missing segments or characters outside the Base64URL alphabet will cause a decoding error.
What is Base64URL encoding?
Base64URL is a URL-safe variant of Base64 that replaces "+" with "-", "/" with "_" and omits padding. It lets tokens travel safely in URLs, headers and cookies.
Can I decode RS256 or ES256 tokens?
Yes. Decoding works for every algorithm because it only reverses the encoding. Verifying asymmetric signatures, however, requires the matching public key.
Can I edit the payload and reuse the token?
You can modify the decoded JSON, but any change invalidates the signature. A server that verifies signatures will reject the edited token unless it is re-signed with the correct key.
Related JWT Tools
- JWT Inspector — Comprehensive analysis of JWT token structure and claims
- JWT Claims Viewer — View all JWT claims in a tree-style format
- JWT Signature Verifier — Verify JWT signature with secret or public key
- JWT Payload Formatter — Pretty print JWT payload with proper indentation