JWT Decoder Online — Decode JSON Web Tokens
A JSON Web Token, or JWT, is a compact way for a website or an API to pass information about a user between systems. When you log in to a modern web app, the server often hands your browser a JWT, and your browser sends it back with every request as proof of who you are. The token is a single string made of three parts separated by dots: a header, a payload and a signature. The header says which algorithm was used to sign the token, the payload carries the claims, such as the user ID, the name and the expiry time, and the signature proves the token was issued by someone holding the secret key. This free JWT decoder reads the first two parts and shows them as readable, formatted JSON, so you can see exactly what a token contains. Everything runs in your browser, and the token is never uploaded or stored. There is one thing this tool deliberately does not do: it does not verify the signature.
Decoding a JWT only requires reading the Base64 parts, and anyone can do that, which is an important fact in itself. A JWT is not encrypted, so its payload is readable by anyone who holds the token, and you should never put sensitive information such as a password or a credit card number inside one. Verifying a signature requires the secret key or the public key of the issuer, and that check belongs on the server that accepts the token, not in a browser tool. It clearly labels the signature as not verified, and it warns you never to paste a production token from a real user into any online tool, including this one.
Warning: Never paste a production token, a real user token or a token from a live system into any online tool. This tool decodes only — it does not verify signatures.
Decoded Token
Paste a token above and click Decode Token.
Header
Payload (claims)
Decoding only: this tool does not verify the signature. A token can be decoded by anyone, which proves nothing about whether it is genuine or still valid.
What Are the Three Parts of a JWT?
A JWT has three Base64URL-encoded parts joined by dots. The header is a small JSON object that usually names the signing algorithm, such as HS256, and the token type, JWT. The payload is a JSON object of claims, which are name and value pairs about the user and the token: "sub" is the subject, usually the user ID; "name" is the user's name; "iat" is the issued-at time as a Unix timestamp; and "exp" is the expiry time, after which the token should be rejected. The signature is created by signing the header and payload together with a secret key, and it is what lets a server trust that the token was issued by the right party and has not been tampered with. If any character of the header or payload changes, the signature no longer matches, and a server that checks it will reject the token.
Why Decoding Is Not Verifying
It is easy to confuse decoding with verifying, because both start with reading the token. Decoding is just Base64 decoding: it tells you what the token says. Verifying is a cryptographic check: it proves that the token was signed by someone holding the right key and that it has not been altered since. A token with a forged payload and a fake signature will still decode perfectly, and its payload will look completely convincing, which is exactly why servers must verify signatures and why a browser tool cannot do the job for them. So use this decoder to inspect the contents of a test token while you build a login flow, check the expiry time, and confirm the claims are what you expect, then let your server verify the signature with its own key.
How to Use
- Paste the token into the box. A JWT is one long string with two dots in it. The box starts with the well-known example token from jwt.io, which you can replace with your own test token.
- Click Decode Token. The header and payload appear as formatted JSON, and the issued-at and expiry times are shown as readable dates where present.
- Read the payload claims. Check the user ID, the name and the expiry time, and confirm they are the values your application expects.
- Remember that the signature is not verified. The signature part is shown but never checked here. Never paste a production token into this or any other online tool, and never trust a decoded payload on its own.
Worked Example
Decode the sample token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c. The header decodes to:
{
"alg": "HS256",
"typ": "JWT"
}
The payload decodes to:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
The payload shows the name "John Doe", the subject "1234567890" and the issued-at time 1516239022, which is 18 January 2018 at 01:30:22 UTC. The signature part is SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c, and this tool shows it without verifying it.
Frequently Asked Questions
What is a JWT?
A JSON Web Token is a compact, URL-safe string that carries claims about a user, such as their ID and name, in a header and a payload, plus a signature. Servers use JWTs to prove a user is logged in without storing session state.
Does this tool verify the signature?
No. This tool decodes only. It reads the header and payload so you can inspect them, but it never checks the signature, because verification needs the issuer's secret or public key. A decoded payload proves nothing about whether a token is genuine.
Is the payload of a JWT secret?
No. The payload is only Base64URL-encoded, not encrypted, so anyone holding the token can read it. Never put passwords, private data or secrets in a JWT payload.
What do iat and exp mean?
The iat claim is the issued-at time, and exp is the expiry time. Both are Unix timestamps in seconds. A server should reject a token after its exp time, and this tool shows both as readable dates when they are present.
Is it safe to paste a token into this decoder?
Only paste test tokens that have no real access. Never paste a production token or a real user's token into any online tool, because anyone who copies it could use it as that user until it expires.