JWT Decoder - Decode JWT Tokens Online
Free online JWT decoder. Decode JSON Web Tokens and inspect JWT header and payload directly in your browser.
More Tools
What is JWT?
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are compact, URL-safe tokens that are commonly used for authentication, authorization, and information exchange in web applications. A JWT consists of three parts: a header, a payload, and a signature, separated by dots. The header and payload are Base64URL-encoded JSON objects that can be decoded by anyone — only the signature requires a secret key for verification.
How JWT Works
JWTs are widely used in modern web applications for stateless authentication. When a user logs in, the server creates a JWT containing user information and signs it with a secret key. The client stores the token and sends it with each subsequent request. The server can verify the token's authenticity using the secret key without needing to maintain session state. JWTs are also used for single sign-on (SSO), API authorization (Bearer tokens), and secure information exchange between services.
JWT Structure Explained
Header
Contains metadata about the token, including the signing algorithm (e.g., HS256, RS256) and the token type (JWT). The header is always Base64URL-encoded JSON.
Payload
Contains the claims — statements about the user and additional data. Common claims include sub (subject), name, iat (issued at), and exp (expiration). The payload is Base64URL-encoded JSON and can be decoded by anyone.
Signature
Created by combining the encoded header, encoded payload, and a secret key using the algorithm specified in the header. The signature verifies that the token hasn't been altered and that it was created by a trusted source.
JWT Decoder vs JWT Validator
A JWT decoder simply decodes the Base64URL-encoded header and payload parts of a JWT — no secret key is required. Anyone with the token can see its contents. A JWT validator goes further: it verifies the cryptographic signature to confirm the token's authenticity, checks expiration times, validates the issuer, and ensures the token hasn't been tampered with. This tool is a JWT decoder only — it does not perform any signature verification or validation.
Common JWT Claims
issIssuer — who issued the tokensubSubject — who the token is aboutaudAudience — who the token is intended forexpExpiration — when the token expiresiatIssued At — when the token was createdHow to Use JWT Decoder
- 1
Paste your JWT token into the input area
- 2
The tool automatically decodes and displays the header and payload
- 3
Click "Copy" to copy the decoded header or payload JSON
- 4
Use the sample token button to see an example JWT in action
Frequently Asked Questions
Can JWT be decoded without a secret?
Yes. The header and payload parts of a JWT are Base64URL-encoded, which is a reversible encoding — not encryption. Anyone with access to the token can decode these parts to view the contents. Only the signature requires a secret key for verification. This is why sensitive data should never be stored in a JWT payload; it should only contain public, non-sensitive information.
Does decoding verify the JWT signature?
No. This tool only decodes the JWT header and payload. It does not perform cryptographic signature verification. To fully verify a JWT, you need the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms) and a JWT verification library.
What is the difference between Base64 and Base64URL?
Base64URL is a variant of Base64 encoding that is URL-safe. It replaces '+' with '-', '/' with '_', and removes the '=' padding characters. JWTs use Base64URL to ensure the token can be safely included in URLs and HTTP headers without additional encoding.
Is my JWT token sent to a server?
No. All JWT decoding happens entirely in your browser using JavaScript. Your token data never leaves your device — we do not upload, store, or share any token data. Your privacy and security are fully protected.