JSON Web Tokens (JWTs) are the standard way modern web applications pass authentication and authorization information between a client and a server, and they're everywhere in modern development — but their compact, encoded form makes them unreadable at a glance. This decoder instantly breaks a JWT down into its header, payload, and signature, showing exactly what claims and data it actually contains, entirely in your browser.
What's actually inside a JWT
A JWT consists of three parts separated by periods: a header describing the token's type and signing algorithm, a payload containing the actual claims (like a user ID, expiration time, and any custom data the issuer chose to include), and a signature that verifies the token hasn't been tampered with. The header and payload are simply Base64-encoded JSON — not encrypted — meaning anyone can decode and read them; only the signature requires a secret key to verify or forge.
How to use it
- Paste a JWT into the input field.
- The tool instantly decodes and displays the header and payload as readable JSON.
- Review the claims — expiration time, issuer, subject, and any custom fields — to debug or inspect the token's contents.
A critical security point about JWTs
Because the header and payload are only encoded, not encrypted, a JWT should never be used to store sensitive information that shouldn't be readable by anyone who gets hold of the token — assume anyone with the token can read every claim inside it. The signature's job is verifying the token's authenticity and integrity (that it was issued by a trusted source and hasn't been altered), not keeping its contents secret.
Common debugging scenarios
- Checking token expiration — decoding a JWT to see its exact expiration timestamp when debugging an unexpected "session expired" error.
- Verifying claims during development — confirming a token actually contains the user ID, roles, or permissions your application code expects it to contain.
- Debugging authentication integration issues — inspecting a token from a third-party identity provider to understand exactly what claims format it uses.
- Learning how JWTs work — decoding real tokens is one of the fastest ways to understand the format concretely rather than only reading about it abstractly.
Frequently asked questions
Can this tool verify a JWT's signature? Decoding shows the token's contents without requiring the secret key; verifying the signature specifically requires the issuer's secret or public key, which this tool doesn't need or request.
Is my token uploaded anywhere? No — decoding happens entirely locally in your browser; nothing is sent to a server, which matters given how sensitive a live authentication token can be.
Should I decode a real production token from a live application? Be cautious — treat any real authentication token as sensitive, and prefer testing with expired or clearly non-production tokens where possible.
Why can I read the payload without any key? Because the payload is Base64-encoded, not encrypted — encoding is fully reversible by design and requires no secret to decode.