JWT Token
Decoded Header
Decoded Payload
Common Claims
How it works
JWTs are compact, URL-safe tokens commonly made of three dot-separated parts: header, payload, and signature. The header and payload are Base64URL-encoded JSON segments, so a decoder tool can split the token, convert Base64URL to standard Base64, decode the bytes, and parse the JSON for inspection.
- JWTs usually contain three sections: header, payload, and signature.
- The header and payload are human-readable after Base64URL decoding and JSON parsing.
- Decoding is useful for debugging claims like `iss`, `sub`, `aud`, `iat`, and `exp`, but it is not the same as cryptographic verification.
Frequently Asked Questions
No. The decoding happens entirely in your browser using JavaScript. Your token is never sent to a server, so it's safe to decode tokens containing sensitive claims.
No. This tool only decodes the header and payload sections of a JWT for inspection. It does not verify the signature, so decoding a token does not prove it is authentic or untampered.
A JWT is made of three dot-separated parts: a header describing the algorithm and token type, a payload containing the claims, and a signature used to verify integrity.
iat is the issued-at timestamp, exp is the expiration timestamp, iss identifies the issuer, sub identifies the subject, and aud identifies the intended audience of the token.
Yes, this JWT decoder is completely free with no sign-up required. You can decode unlimited tokens directly in your browser.