JWT Decoder
Decode JSON Web Tokens (JWT) instantly. View headers, payload claims, and signature details securely in your browser.
How to Use
- Paste your JSON Web Token into the left panel.
- The tool automatically parses it into Header, Payload, and Signature.
- Toggle between JSON and Claims Breakdown views for easy reading.
- Click the Eye Icon to hide/mask sensitive values.
- Click the Expand Icon to view the card in full-screen mode.
Features
Instant Decode
Decodes base64url data in real-time.
Claims Table
Visual table breakdown with descriptions.
Hide Values
Mask sensitive data with one click.
100% Private
Tokens never leave your browser.
Use Cases
- Authentication: Debug login flows and verify token contents.
- API Development: Inspect tokens generated by your backend.
- Security Testing: Analyze claims for potential vulnerabilities.
- Troubleshooting: Check token expiration times easily.
Understanding JWTs
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. A JWT consists of three parts separated by dots (.):
- Header: Typically consists of two parts: the type of the token (JWT) and the signing algorithm being used (e.g., HMAC SHA256 or RSA).
- Payload: Contains the claims. Claims are statements about an entity (typically, the user) and additional data.
- Signature: Used to verify the message wasn't changed along the way.
Security Note
This tool decodes the JWT so you can read its contents, but it does not verify the signature. Decoding a JWT is not the same as validating it. Anyone can decode a JWT. For generating secure random strings for your JWT secrets, use the Random String Generator.
Frequently Asked Questions
Is my JWT sent to a server?
No. All decoding happens locally in your browser using JavaScript. Your tokens are completely private and never leave your device.
Why can't I see the signature decoded?
The signature is a cryptographic hash encoded in base64url. It is not JSON, so it cannot be decoded into readable text like the header and payload.
What do 'iat' and 'exp' mean?
These are standard registered claims. 'iat' stands for "Issued At" (when the token was created) and 'exp' stands for "Expiration Time". Both are represented as Unix timestamps.
Does this tool validate the JWT?
No, this tool only decodes the base64url encoded strings. It does not verify the cryptographic signature against a secret key.
Is it free?
Yes, 100% free with no limits.