⌘ K
jwt · header · payload · signature · live

Decode any JWT token

Paste a JSON Web Token to inspect its header, payload claims, and signature. Decoding is inspection only — no secret needed. Runs entirely in your browser.

JWT Decoder
Token
155 B
3 parts
Algorithm
HS256
header.alg
Expiry
—
no exp
Status
decoded
live
JWT structure: header.payload.signature
input · jwt token
output · decoded
header
{
  "alg": "HS256",
  "typ": "JWT"
}
payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Quick Start

How to decode a JWT: a complete step-by-step guide

A JSON Web Token (JWT) is three base64url-encoded segments — header.payload.signature — joined by dots. The first two segments are JSON; the third is a cryptographic signature computed against the issuer's secret or private key. This tool decodes all three locally so you can inspect RFC 7519 claims without sending the token anywhere.

  1. 01

    Paste a JWT from a request header

    Drop a JWT from an Authorization: Bearer header, an OAuth callback, a cookie, or a query parameter. Tokens always start with eyJ — that's {" base64url-encoded.

    Validation runs as you type. Each of the three dot-separated segments is decoded independently; if any segment isn't valid base64url, the exact position is highlighted.

    Bearer tokenOAuthcookiebase64urlRFC 7519
    input · raw token3 segments
    eyJhbGci….eyJzdWIi….SflK…
    210 B · 1 lineJWS compact
  2. 02

    Read the header — algorithm and key hint

    The header is a tiny JSON object with the signing algorithm (alg) and token type. Common values: HS256 (HMAC-SHA256), RS256 (RSA-SHA256), ES256 (ECDSA P-256), or EdDSA.

    Watch for "alg": "none" — a historical attack vector where attackers strip the signature. If you see it on a production token, treat it as suspicious.

    HS256RS256ES256EdDSAalg=none
    header · decodedRFC 7515
    { "alg": "HS256", "typ": "JWT" }
    36 B · 1 segmentparsed · safe
  3. 03

    Inspect payload claims and expiry

    The payload is JSON with registered claims (iss, sub, aud, exp, iat, nbf, jti) plus any custom fields the issuer added (roles, scopes, tenant ID, user attributes).

    Timestamps are Unix epoch seconds; the tool shows the human-readable date next to each. If exp is in the past, the token is expired even if the signature is still valid.

    isssubexpiatscopeUnix epoch
    payload · claimsiat → exp
    { "sub": "1234567890", "name": "John Doe" }
    120 B · 7 claimsexpires in 14 min
  4. 04

    Copy decoded view or verify signature elsewhere

    Grab the formatted header + payload + signature block to paste into a ticket, share with a teammate, or feed into a verifier. The signature itself stays raw — you'll need the issuer's secret or public key (JWK / PEM) to verify it.

    Decoding is not verification. This tool inspects the contents; use the JWT Encoder or your JWKS endpoint to confirm the signature is genuine.

    clipboardJWKSverificationsignatureprivacy-first
    exportdecoded blob
    Copied
    shipped0 outbound
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsJWT EncoderBase64 DecoderHMACSHA-256RSA KeysEd25519 Keys
Use Cases

When to decode a JWT

Debugging auth, inspecting claims, building integrations.

Auth debugging

See exactly what claims your auth provider issued. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Expiry checks

Spot-check the exp claim against the current time. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Custom claims

Inspect non-standard fields used by your app. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Cross-team handoff

Show a teammate the exact contents of a token. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Pen testing

Verify tokens don't leak sensitive data in the payload. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Integration tests

Build assertions against decoded JWT payloads. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

No — this tool only decodes. Use the JWT Encoder to sign new tokens, or your auth library to verify a signature against your issuer's key.
Yes. Decoding is done entirely in your browser — your token is never sent to any server.
JWT payloads are base64url-encoded, not encrypted. Anyone with the token can read them. The signature only proves authenticity.
An opaque base64url string — bytes from HMAC-SHA256, RSA-PKCS1, or ECDSA depending on the algorithm.
No. Decoding runs locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!