JWT Decoder
Decode JSON Web Tokens (JWT) online. Inspect header and payload, runs entirely in your browser.
About JSON Web Tokens
A JWT (JSON Web Token, pronounced "jot") is three base64url-encoded segments separated by
dots: header.payload.signature. The header declares the signing algorithm; the
payload is a JSON object containing claims (subject, expiry, custom data); the signature
proves the token was issued by someone holding the secret or private key. JWTs are the most
common shape of bearer token in modern web auth.
How to use
Paste a JWT into the input and press Decode. The tool splits the token, base64url-decodes the first two segments, parses each as JSON, and shows the header, payload, and signature side-by-side. The signature is shown but not verified — verification requires the issuer's secret key (HS*) or public key (RS*/ES*) which only lives on the server. Treat the decoded payload as untrusted until you have verified the signature elsewhere.
Privacy
Decoding runs entirely in your browser. The token is never uploaded.