JWT Decoder
Decode JWT header and payload instantly.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Note: this decodes the token only; it does not verify the signature.
About JWT Decoder
Decode a JSON Web Token to inspect its header, payload, and claims. A JWT is a compact, signed token widely used for authentication and API authorization, and it packs its data into three Base64 segments that are not human-readable at a glance. Paste a token to instantly reveal the decoded header and payload, including standard claims like the issuer, subject, and expiry, so you can debug login flows and API calls. The decoding happens entirely in your browser and the token is never sent to a server, which matters because tokens are sensitive credentials. This tool decodes and does not verify signatures, and it is free with no signup.
How to use this tool
- 1Paste your JWT token.
- 2The decoded header and payload appear instantly.
- 3Check the expiry and claims.
Standard JWT claims reference
A JWT payload is a set of 'claims' - named fields describing the token. The RFC 7519 spec registers a handful of standard claims that most tokens use. Knowing them makes decoded tokens much easier to read.
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created and signed the token |
| sub | Subject | Who the token is about (usually a user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration | Unix timestamp after which the token is invalid |
| nbf | Not before | Unix timestamp before which the token is invalid |
| iat | Issued at | Unix timestamp when the token was created |
| jti | JWT ID | Unique identifier, used to prevent replay |
Remember: decoding is not verifying. Anyone can read a JWT's contents - the base64url payload is not encrypted. Only checking the signature against the issuer's key proves the token is authentic, and this tool intentionally does not do that, so never trust decoded values from an unverified token.
Frequently asked questions
Is it safe to paste tokens here?
Decoding happens entirely in your browser and nothing is sent anywhere. Still, avoid sharing production tokens with anyone.
Does this verify the signature?
No. It decodes the Base64 content only. Signature verification requires the signing key and should happen server-side.
Related guide
7 min readJWTs Explained: How They Work and 6 Mistakes That Get Apps Hacked
What's actually inside a JSON Web Token, how signing works, and the six most common JWT security mistakes developers still make.