JSON Web Tokens power authentication in a huge number of modern web applications and APIs. When you are debugging a login flow or an API integration, you often need to decode a JWT to see what is inside it. Our free JWT decoder reveals the header and payload of any token instantly — and because it runs entirely in your browser, your token never leaves your device.
What Is a JWT?
A JWT (JSON Web Token) is a compact, self-contained way to transmit information between parties as a signed token. It is most commonly used for authentication: after you log in, a server issues a JWT that your browser sends with each subsequent request to prove who you are.
A JWT is a single string made of three parts separated by dots:
header.payload.signature
Each part is Base64URL-encoded, which is why a raw JWT looks like meaningless gibberish until you decode it.
The Three Parts of a JWT
Header
The header describes the token — typically the signing algorithm (such as HS256 or RS256) and the token type (JWT).
Payload
The payload contains the claims — the actual data. Standard claims include sub (subject/user ID), iat (issued-at time), and exp (expiration time), alongside any custom data the application includes, such as roles or permissions.
Signature
The signature is created by signing the header and payload with a secret or private key. It lets the server verify that the token has not been tampered with. Decoding does not require the secret — but verifying the signature does.
How to Decode a JWT Online
- Paste your JWT into the input box.
- View the decoded header and payload as readable JSON.
- Inspect the claims — including issued-at and expiration times.
The token is decoded locally in your browser, so sensitive tokens are never transmitted anywhere.
Important: Decoding Is Not Verifying
A crucial point: anyone can decode a JWT. The header and payload are only encoded, not encrypted — they are readable by design. The signature is what provides security, by letting the server confirm the token is authentic and unmodified.
This means two things: never store sensitive secrets in a JWT payload, since anyone holding the token can read it; and decoding a token in a tool like this is perfectly safe for inspection, but does not prove the token is valid.
Common Uses for a JWT Decoder
Debugging authentication — Check what claims a token carries and confirm the user ID, roles, and expiry are correct.
API integration — Inspect tokens returned by a third-party service to understand their structure.
Troubleshooting expiry — Read the exp claim to see whether a token has expired.
Frequently Asked Questions
Is the JWT decoder free? Yes — it is free, requires no sign-up, and runs entirely in your browser.
Is my token sent to a server? No. Decoding happens locally in your browser, so your token never leaves your device.
Can the tool verify the signature? Decoding shows you the header and payload without the secret key. Verifying the signature requires the server's secret or public key and is done by the application, not the decoder.
Why does my JWT look like random characters? Each part of a JWT is Base64URL-encoded. Decoding reveals the readable JSON header and payload inside.
Debugging a login or API issue? Paste your token and decode the JWT in seconds.