JWT Decoder
JWT
This decodes the header and payload only — it does not (and cannot, without your secret key) verify the signature.
Other tools in Developer Tools
About JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe way to represent a set of claims — typically information about an authenticated user and their permissions — and it's the backbone of authentication in a huge share of modern web APIs and single sign-on systems. A JWT is made of three Base64URL-encoded segments joined by periods: a header (describing the token's type and signing algorithm), a payload (the actual claims — things like user ID, expiration time, and roles), and a signature (used to verify the token hasn't been tampered with).
This tool decodes the header and payload of any JWT you paste in, converting their Base64URL-encoded segments back into readable JSON. This is genuinely useful for debugging authentication issues without needing to write code: checking what claims a token actually contains, verifying an expiration timestamp (the `exp` claim) to see whether a token has expired, confirming which signing algorithm a token declares in its header, or simply inspecting a token you received from a third-party API to understand its structure.
It's critical to understand exactly what this tool does and doesn't do: decoding a JWT's header and payload requires no secret key at all, because Base64URL is an encoding, not encryption — anyone with the token text can read its contents, which is a normal, expected property of JWTs (they're not meant to be confidential without additional encryption, only tamper-evident). This tool explicitly does not, and cannot, verify the signature, since that requires the server's secret key or public key, which is intentionally never shared and never should be pasted into a third-party tool.
That distinction matters for security: never assume a JWT's claims are trustworthy just because you can read them — trust in a JWT's contents comes entirely from a verified signature check performed server-side with the correct key, not from the mere ability to decode it. This tool is a debugging aid for inspecting token contents, not a substitute for proper server-side signature verification.
How it works
- Paste your JWT. Enter the full token — three Base64URL segments separated by periods.
- View the decoded parts. The header and payload are decoded into readable JSON instantly.
- Copy what you need. Copy the header or payload JSON individually for further use.
Examples
Decoding a JWT payload
Input
...eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0...
Output
{
"sub": "1234567890",
"name": "John Doe"
}