Free Converter
JWT Token Decoder
Decode JWT (JSON Web Token) header and payload instantly in your browser. Free, private, and client-side — no data sent to any server.
Decode JWT (JSON Web Token) header and payload instantly in your browser. Free, private, and client-side — no data sent to any server.
JSON Web Tokens (JWT) are a compact, URL-safe format for transmitting claims between two parties, defined by RFC 7519. A JWT is three base64url-encoded segments separated by dots: header (algorithm and token type), payload (claims), and signature (cryptographic proof of authenticity). The header and payload are JSON, base64url-encoded for URL safety; the signature uses one of several algorithms (HS256, RS256, ES256, and others) over the encoded header and payload.
Decoding a JWT — splitting it into segments and base64-decoding each — does not require any secret. Anyone with the token text can read its header and payload. The signature, however, can only be verified with the secret (HMAC) or public key (asymmetric). Decoding is for inspection; verification is what proves authenticity.
This decoder splits the token, base64-decodes each segment, parses the header and payload as JSON, and shows the result. It does not attempt signature verification because that requires the secret or public key, which the decoder does not have. The decoded output is read-only inspection — useful for debugging tokens but not a substitute for proper verification in application code.
Debugging authentication issues almost always involves inspecting tokens. A token that looks valid in code may have wrong claims, an unexpected algorithm, an expired exp timestamp, or audience mismatch. Decoding the token reveals exactly what the issuer produced.
Inspecting tokens during integration work also helps. When connecting to a third-party API or identity provider, the actual claim names, formats, and structure are best understood by decoding sample tokens rather than relying on documentation that may be outdated.
Paste the token, get the parsed contents.
JWT format is three segments joined by dots. Each segment is base64url-encoded — the URL-safe variant of base64 that uses - and _ instead of + and /, with padding sometimes omitted. Decoding requires undoing the URL-safe substitutions, padding the segment, and base64-decoding.
The header and payload are JSON after decoding. The signature segment is binary (raw signature bytes) and is not human-readable; it requires the verification key to be useful.
Common claims defined in RFC 7519: iss (issuer), sub (subject identifier), aud (audience), exp (expiration as Unix epoch seconds), nbf (not-before timestamp), iat (issued-at timestamp), jti (unique token ID). Application-specific claims can appear with any name.