JWT Decoder

How to Use the JWT Decoder

1. Paste a JWT (three Base64URL segments separated by dots) into the input box.
2. The header and payload are decoded and shown as formatted JSON automatically.
3. The signature segment is displayed as-is, since it cannot be decoded into readable data.
4. Copy any section individually using the copy buttons.

What is a JWT?

A JWT is a string made of three Base64URL-encoded parts separated by periods: `header.payload.signature`. It is commonly used in authentication systems to pass claims — such as a user ID, roles, or an expiration time — between a client and a server in a compact, URL-safe format.

Header, payload, and signature

The header typically describes the token type and the signing algorithm used (e.g. HS256 or RS256). The payload contains the actual claims — the data the token is carrying, such as `sub` (subject), `exp` (expiration), or custom application fields. The signature is created by signing the header and payload with a secret or private key, and it is what allows a server to verify the token has not been tampered with.

Security considerations

Because the header and payload are only Base64URL-encoded — not encrypted — anyone can decode and read them, including this tool. Never put secrets or sensitive data directly in a JWT payload. And critically: decoding a JWT tells you nothing about whether it is legitimate. Verifying a signature requires the correct secret or public key and must happen on a server you trust, using a proper JWT library.

Example

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFkYSJ9.signature

{
  "sub": "1234",
  "name": "Ada"
}

Tips

• This tool never contacts a server — decoding happens fully in your browser.
• Never paste a production access token containing sensitive data into a public tool if you are unsure of its privacy behavior.
• Always verify signatures server-side with a trusted library before trusting any claims from a token.

Frequently Asked Questions