JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact string used to transmit claims between parties — for example to keep a user logged in. It has three parts separated by dots: header.payload.signature. Each part is base64url encoded, which is why the token looks like random letters and numbers.

How to use this tool

1. Paste a JWT (or click “Load sample”).
2. Read the header — algorithm and token type.
3. Read the payload — the claims (subject, expiry, roles…).
4. Copy the decoded JSON with one click.

The three parts

• Header — metadata such as the signing algorithm (HS256, RS256…).
• Payload — the claims: sub (subject), exp (expiry), iat (issued at), aud (audience) and any custom data.
• Signature — proves the token was not tampered with. This tool decodes it but does not verify it (verification needs the secret or public key).

Anatomy of a JWT

A JWT has three parts separated by dots — header.payload.signature:

• Header — algorithm and token type.
• Payload — the claims: sub (subject), exp (expiry), iat (issued-at) and custom data.
• Signature — proves authenticity. Decoding is not verifying: checking the signature requires the secret/public key, which only the server holds.
• Privacy note: payloads are readable by anyone with the token — never put secrets inside. This decoder runs in your browser, so your tokens never leave your device.

Your privacy

Decoding runs entirely in your browser. Your token is never sent to any server and never stored.