JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties, used widely for authentication and authorization in modern web applications and APIs. A JWT has three parts separated by dots: a header describing the signing algorithm, a payload containing the claims (data), and a signature that verifies the token was not tampered with.

The header and payload are Base64URL-encoded JSON — not encrypted — so anyone can read them. Our JWT Decoder splits the token, decodes those two sections into formatted JSON, and shows the signature separately so you can inspect exactly what a token contains.

How to Decode a JWT

• Paste your token, or click Sample to load an example JWT
• The header and payload are decoded into readable, formatted JSON
• Standard claims — issued at (iat), expires (exp), not before (nbf) — are shown as local dates
• The tool indicates whether the token has expired based on its exp claim
• Click Copy on the header or payload to copy that section

Decoding vs Verifying

This tool decodes a JWT — it reads and displays the contents — but it does not verify the signature. Verification requires the secret key or public key used to sign the token and confirms the token is authentic and untampered. Decoding alone simply reveals the claims, which is exactly what you need when debugging.

Because the payload is only encoded and never encrypted, you should never store sensitive secrets in a JWT payload. This decoder makes that point obvious: every claim is plainly visible to anyone who has the token.

Privacy & Security

Decoding happens entirely in your browser — your token is never sent to any server, logged, or stored. This is essential for a JWT tool, since tokens often grant access to real accounts. You can safely inspect production tokens knowing they never leave your device.

The Three Parts of a JWT

A JWT is made of three Base64URL-encoded sections joined by dots, and understanding each is key to working with tokens. The header describes how the token is signed — typically the algorithm, such as HS256 or RS256, and the token type. The payload carries the claims: the actual data, including standard fields like the subject (sub), issuer (iss), issued-at time (iat), and expiry (exp), plus any custom claims your application adds. The signature is a cryptographic hash of the header and payload, created with a secret or private key.

Only the signature provides integrity. The header and payload are merely encoded, not encrypted, which is why this decoder can read them without any key. The signature is what proves the token was issued by a trusted party and has not been altered — but verifying it requires the signing key, which is a separate step from the decoding this tool performs.

Why Choose Our JWT Decoder?

This decoder is completely free, needs no signup, and runs entirely in your browser. For a tool that handles tokens — which frequently grant access to real accounts and APIs — that local-only processing is essential: your token is never sent to a server, logged, or stored, so you can safely inspect production tokens. The decoder also translates timestamp claims like iat and exp into readable local dates and flags whether the token has expired.

The JWT Decoder is one of more than 200 free tools on ToopTools. If you debug authentication regularly, you can pin it to your personalized My Workspace workspace so it sits beside your other developer utilities, always one click away. It works on any modern browser, on desktop and mobile.

Is the JWT decoder free?

Yes. It is completely free with no limits and no signup. You can decode as many tokens as you like, as often as you like, without ever creating an account.

Does it verify the token's signature?

No. This tool decodes a JWT to reveal its header and payload, but it does not verify the signature. Verification requires the secret or public key used to sign the token and confirms authenticity. Decoding alone simply shows the contents, which is what you need when debugging what a token contains.

Is it safe to paste a real token?

Yes. Decoding happens entirely in your browser, so the token is never transmitted, logged, or stored anywhere. That said, treat any live token as a credential — it grants access while it is valid — and avoid sharing it with others or pasting it into tools you do not trust.

Can I read the expiry and issued-at times?

Yes. The decoder recognizes the standard time claims — issued at (iat), expires (exp), and not before (nbf) — and displays them as readable local dates. It also indicates whether the token has already expired based on its exp claim, so you can quickly diagnose authentication failures.

Why can anyone read the payload?

Because a JWT payload is only Base64URL-encoded, not encrypted. Encoding makes the data URL-safe but does nothing to hide it — anyone with the token can decode it instantly. For that reason you should never store passwords or other secrets in a JWT payload; assume every claim is fully visible.

Tips for Working with JWTs

• Never put sensitive secrets in the payload — it is readable by anyone with the token
• Check the exp claim first when debugging 'unauthorized' errors; the token may simply be expired
• Look at the header's alg field to confirm the expected signing algorithm is being used
• Remember that decoding is not verification — only the signing key proves authenticity
• Treat tokens as credentials and avoid sharing them or committing them to repositories

Key Features

• Splits a JWT into header, payload, and signature
• Decodes the Base64URL header and payload into formatted, readable JSON
• Translates iat, exp, and nbf claims into local dates
• Shows whether the token has expired
• One-click copy of the header or payload
• 100% browser-based — your token never leaves your device

How do I decode a JWT token?

Paste your JSON Web Token and the tool instantly splits it into its header and payload and decodes both into readable JSON, including claims like the expiry and issued-at times. Everything is decoded in your browser, so the token never leaves your device.

Does the JWT decoder work offline?

Yes. Decoding happens entirely in your browser, so once the page has loaded the tool works without an internet connection and your token is never uploaded or logged — which matters because tokens grant access to accounts and APIs.