JWT Decoder

JWT Decoder is a free encode & crypto tool that runs entirely in your browser — inspect header & payload claims. No upload, no account, no limits.

Loading JWT Decoder…

How to use JWT Decoder

Open the JWT Decoder tool.
Paste or type your text, code or a token into the input field.
The output updates as you type — adjust the options if you need a different format.
Copy the result, or share the URL to hand the exact input to someone else.

About JWT Decoder

A JSON Web Token packs three Base64url segments — header, payload and signature — separated by dots. This tool splits the token and decodes the header and payload so you can read the claims inside, entirely in your browser.

Decoding is not verification: it reveals what a token claims, not whether the signature is valid. Treat the payload as readable-but-untrusted until the issuer's signature is checked server-side.

What people use it for

Inspect the claims (sub, exp, iat, roles) in a token returned by an auth API.
Debug a rejected session by checking the exp expiry and iat issued-at times.
Confirm which algorithm (alg) and key id (kid) a token was signed with.
Read a token pulled from a request header without pasting it into an untrusted site.

Frequently asked questions

Is my token sent anywhere?

No. Decoding happens locally in your browser with no network request — nothing about the token leaves your machine.

Does this verify the signature?

No. It decodes the header and payload for inspection. Verifying requires the issuer's secret or public key — use the JWT Signer tool to build HMAC-signed tokens.

Why does the token look like gibberish?

JWTs are Base64url-encoded, not encrypted. Anyone can decode the header and payload, so never put secrets in a JWT payload.

Is it private?

Every calculation happens on this page, in your own browser. Your input is never sent to a server, never logged and never used for training — which also means the tool keeps working when you are offline.