JWT Decoder Online — Decode JSON Web Tokens
Decode and inspect JWT (JSON Web Token) headers, payloads, and claims.
Frequently Asked Questions
How do I decode a JWT token online?
Paste your JWT token into the input box. Our decoder instantly splits and decodes the header (algorithm info) and payload (claims data) into readable JSON.
Is my JWT token safe when decoded here?
Yes! All decoding happens entirely in your browser using JavaScript. No data is sent to any server. Your tokens remain completely private and secure.
Can this verify JWT signatures?
This tool decodes and displays JWT contents (header and payload). Signature verification requires the secret key or public key and is not performed client-side for security reasons.
What JWT claims can I see?
All standard claims are displayed: sub (subject), iss (issuer), exp (expiration), iat (issued at), aud (audience), and any custom claims in the payload.
Privacy First: All processing happens directly in your browser. Your data never leaves your device.
About JWT Decode
A JSON Web Token is three Base64URL-encoded segments joined by dots. Decoding one reveals its header and claims instantly — which is useful for debugging, and a reminder that a JWT hides nothing from whoever holds it.
The three segments
The header declares the signing algorithm and token type. The payload carries the claims. The signature is computed over the first two segments and verifies that they have not been altered.
Only the signature depends on a secret. The header and payload are encoded, not encrypted, so any party that receives a token can read every claim in it.
eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiIxMjM0In0 . dBjftJeZ4CVP-mB92K27uhbUJU1p1r
|______ header ____| |____ payload ___| |________ signature _______|
{ "alg": "HS256", "typ": "JWT" } header, decoded
{ "sub": "1234", "exp": 1735689600 } payload, decodedNever put secrets in a payload
Because the payload is readable by anyone holding the token, it must not contain passwords, API keys, internal identifiers you would not expose, or personal data beyond what the client is entitled to see. Treat everything in a JWT as public.
A related consequence: a token cannot be un-issued. Until it expires it remains valid to any service that trusts the signature, which is why short expiry times and a revocation strategy matter more for JWTs than for session cookies.
Reading the standard claims
- exp — expiry, as a Unix timestamp in seconds. Note that it is seconds, not milliseconds; a factor-of-1000 mistake here produces tokens valid for millennia.
- iat — issued-at. Useful for reasoning about token age independently of expiry.
- nbf — not-before. The token is invalid until this time, which catches clock-skew bugs between services.
- sub — subject, conventionally the user identifier.
- iss and aud — issuer and audience. A verifier that skips the audience check will happily accept a valid token minted for a different service.
Decoding is not verifying
This tool reads the token; it does not check the signature, because doing so would require the signing secret. A decoded token tells you what a token claims, never whether those claims are trustworthy. Signature verification belongs on your server, with the algorithm pinned — accepting the header algorithm value at face value, and in particular accepting none, is a classic authentication bypass.