Developer Tools
Decode and inspect JWT tokens without verifying the signature.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}JWT (JSON Web Token) consists of three Base64-encoded parts separated by dots: header.payload.signature. This decoder displays the decoded header and payload content. Note: This tool does not verify the signature—use server-side validation for security-critical operations.
A JWT (JSON Web Token) is a compact, URL-safe string that encodes claims (data) in three base64-encoded parts separated by dots: header.payload.signature. The decoder splits this string, decodes each part, and displays the JSON data in a readable format so you can see what information is actually stored in your tokens.
The JWT decoder works by splitting the token at each dot separator to extract the three components. It then base64-decodes the header and payload sections and displays them as formatted JSON. The signature section remains encoded because it's cryptographic proof that the token hasn't been tampered with—you can't validate it without the secret key, but you can still see what's signed. Paste your token, and the tool instantly reveals all readable claims.
| Input | Result | Notes |
|---|---|---|
| eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c | Header: {"alg": "HS256", "typ": "JWT"}, Payload: {"sub": "1234567890", "name": "John Doe", "iat": 1516239022} | Decodes a standard JWT to show algorithm type, user identity, and when it was issued |
| eyJhbGciOiJSUzI1NiIsImtpZCI6IjIwMjEtMDUtMDEifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhdWQiOiJjbGllbnRfaWQiLCJleHAiOjE2MjI1NDc0MDB9.signature... | Header: {"alg": "RS256", "kid": "2021-05-01"}, Payload: {"iss": "https://accounts.google.com", "aud": "client_id", "exp": 1622547400} | Shows OAuth token from Google with issuer, audience, and expiration time for verification |
| eyJhbGciOiJub25lIn0.eyJyb2xlIjoiYWRtaW4iLCJ1c2VyX2lkIjoxMjN9. | Header: {"alg": "none"}, Payload: {"role": "admin", "user_id": 123} | Reveals an unsigned token (alg: none) that is cryptographically insecure and should never be used |
No. Decoding reads the claims but does not verify the signature. Validation requires cryptographic verification with the issuer's secret or public key. Always validate JWTs received from external sources before trusting them.
Yes, JWT decoding is client-side—no server is needed. Your token never leaves your browser, so it's safe to decode sensitive tokens locally.
The decoder will display an error showing which part failed to decode. Check that you've copied the entire token exactly and that it contains exactly two dots separating three parts.
The signature is displayed in base64 form, but it's cryptographic proof of authenticity—decoding it visually doesn't reveal anything meaningful. Only the issuer's secret or public key can verify it.
Standard claims include: iss (issuer), sub (subject/user ID), aud (audience/app), exp (expiration time), iat (issued at), and nbf (not before). Custom claims depend on your app.
JWTs are base64-encoded, not encrypted—anyone can decode them and see all claims. Never store passwords, credit cards, or highly sensitive PII in token payloads.