Free JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to carry claims between two parties, most often for authentication and authorization. It has three parts separated by dots: a header, a payload, and a signature. The header and payload are Base64url-encoded JSON, so they are readable by anyone; the signature is what proves the token has not been tampered with.

How to use this JWT decoder

Paste a token in the box and click Decode, or press Load sample to see an example. The tool splits the token and shows the decoded header and payload as formatted JSON, plus the raw signature. Decoding starts as soon as you paste, and it all happens in your browser, so your token is never sent anywhere.

JWT FAQ

Does decoding verify the token? No. Decoding only reads the header and payload. Verifying a JWT means checking the signature against the issuer key, which requires the secret or public key and should be done server-side.

Is it safe to paste a token here? Yes. This decoder runs entirely in your browser and never transmits the token. Still, treat production tokens as secrets and avoid pasting them into tools you do not trust.

What are the common claims? Typical payload claims include sub (subject), iat (issued at), exp (expiry), iss (issuer), and aud (audience).