Free online tool
JWT Decoder
Paste a JSON Web Token and see the decoded header and payload — never sent to a server.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims transferred between two parties. It has three parts separated by dots: a header describing the signing algorithm, a payload containing the claims (like user ID or expiry), and a signature that lets the server verify the token hasn't been tampered with. Only the signature is secret — the header and payload are just base64url-encoded JSON that anyone can read.
Why decode locally
Many online JWT decoders send your token to a server. Because JWTs often contain personal information and can be used to impersonate a user, that's a real security risk. This decoder does everything in your browser — nothing is transmitted anywhere.
+Does this verify the signature?
No. Verifying a signature requires the secret or public key. This tool only decodes the readable parts.
+Is a JWT encrypted?
Standard JWTs are signed, not encrypted. Never store secrets inside a JWT payload.
Decoding a token is not the same as trusting it
A JSON Web Token is three Base64URL-encoded segments joined by dots — header, payload, and signature. Decoding the first two is just string manipulation anyone can do instantly; verifying the third is a cryptographic operation that requires the issuer's secret or public key, which a client-side decoder never has.
JWTs are used everywhere from single sign-on flows to API authentication, and being able to inspect one quickly — without wiring up a verification library just to see what's inside — is one of the most common reasons developers reach for a standalone decoder while debugging an auth failure.
What decoding actually shows you
The header typically reveals the signing algorithm, like HS256 or RS256, and sometimes a key ID. The payload holds the claims — subject, issuer, expiry, and whatever custom fields the issuer packed in. Since none of this is encrypted, anyone who intercepts a token, whether they're the intended recipient or not, can read every claim inside it, which is why sensitive data like passwords or full card numbers should never live in a JWT payload.
The verification gap
Seeing a token's claims does not confirm those claims are genuine. A modified payload with a stripped or altered signature will still decode into readable JSON here, because decoding ignores signature validity entirely. Only a server holding the correct verification key can confirm the token hasn't been tampered with, so never treat a client-decoded payload as authorization proof in your own application logic.
The expiry gotcha
The exp and iat claims are Unix timestamps in seconds, not milliseconds, and it's common to compare them against Date.now() (milliseconds) without converting, which makes every token look either already expired or not expiring for another few centuries. When debugging a rejected token, check that unit mismatch before assuming the server's clock or your token generation logic is broken.
The alg:none attack and why it still matters
Early JWT libraries in some ecosystems would accept a token whose header declared alg as none and skip signature verification entirely, letting an attacker forge arbitrary claims by simply omitting a signature. Most libraries have patched this by requiring the verifier to explicitly allow which algorithms are acceptable, but it's a good reminder that a decoder showing you a valid-looking header and payload tells you nothing about whether a vulnerable verifier on the other end would have rejected it.
Reading standard versus custom claims
Registered claims like iss, sub, aud, exp, nbf, and iat follow a documented meaning in the JWT spec, while anything else in the payload is a custom claim the issuer defined for their own application, such as roles or a tenant ID. Confusing a custom claim's name with a registered one — assuming a field called role behaves like a standard claim, for instance — is a common source of confusion when integrating with an unfamiliar identity provider.
People also search for
- jwt decoder online
- decode json web token
- jwt payload viewer
- verify jwt signature
- jwt expiry check
- jwt debugger tool
- jwt claims explained
- decode bearer token