What is JWT Decoder
The JWT Decoder inspects JSON Web Tokens by parsing their three Base64Url-encoded components — header, payload, and signature — and displaying the decoded JSON in a human-readable format. JWTs are compact, self-contained tokens used for authentication and authorization in web applications. The header specifies the signing algorithm (e.g., HS256, RS256), the payload carries the claims (user ID, expiration, roles), and the signature proves the token was issued by a trusted party.
This tool performs decoding only — it does not verify the signature against a secret or public key. Verification requires access to the signing key, which this tool intentionally does not request. For signature verification, use the dedicated JWT HS256 Verifier or JWT RS256 Verifier tools instead. The decoder is useful for quickly inspecting unfamiliar tokens, debugging authentication flows, and understanding what claims a token contains.
How to Use JWT Decoder
- Paste the full JWT string into the input panel. A valid JWT has the format
header.payload.signature — three dot-separated Base64Url-encoded segments. - Read the decoded output. The tool displays the header (algorithm and type), the payload (claims and metadata), and notes whether a signature is present.
- Check the expiration. If the payload contains an
exp claim, the tool highlights whether the token is currently valid, expired, or not yet active. - Inspect specific claims. Common claims like
sub (subject), iss (issuer), aud (audience), and roles are displayed with clear labels.
Why Use JWT Decoder
When debugging authentication issues, the first step is always to decode the JWT and confirm its contents. Is the user ID correct? Has the token expired? Does it carry the expected roles? A JWT that looks valid on the surface may contain stale claims, a wrong issuer, or missing permissions — and decoding it takes seconds versus minutes of log diving.
Developers working with OAuth 2.0 flows use this tool to inspect access tokens returned by identity providers. API testers use it to verify token payloads before making authenticated requests. Security auditors use it to check for sensitive data leaks — if a JWT payload contains PII (personally identifiable information), that is a design issue worth flagging, since JWTs are only encoded, not encrypted.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
Does this tool verify the JWT signature?
No. This decoder performs decoding only — it Base64Url-decodes the three segments and pretty-prints the JSON. Signature verification requires the signing secret or public key, which is a separate operation. Use the JWT HS256 Verifier (for symmetric keys) or JWT RS256 Verifier (for asymmetric keys) if you need to confirm a token's authenticity.
What if my JWT has only two segments?
A standard JWT always has three segments separated by dots: header.payload.signature. If you see only two segments, the token may be a JWS (JSON Web Signature) with an empty signature, or it may be a different token format entirely (like a simple Base64-encoded session token). The decoder will still attempt to parse whatever you paste, but it will flag the missing signature.
Is it safe to paste production JWTs here?
Since the tool runs entirely in your browser with no network requests, pasting a JWT is as safe as opening it in any client-side tool. However, be aware that JWT payloads are encoded, not encrypted — anyone with the token can already read its contents. The risk is not in decoding but in who has access to the token itself. For highly sensitive tokens, consider using a local development tool rather than a shared browser session.
What is the difference between JWT Decoder and JWT Visualizer?
The JWT Decoder shows the raw decoded JSON in a structured format, which is what you need for debugging and inspection. The JWT Visualizer renders the token's structure as a visual diagram, showing the three segments color-coded with metadata like algorithm and expiration. Use the Decoder for quick inspection; use the Visualizer when you want a presentable overview for documentation or presentations.