LOADING
PLEASE WAIT...
LOADING
PLEASE WAIT...
Paste any JSON Web Token and read its header, payload and claims as readable JSON. Decoding happens locally in your browser.
{
"alg": "HS256",
"typ": "JWT"
}{
"iss": "https://multitoolbox.online",
"sub": "1234567890",
"aud": [
"api",
"web"
],
"name": "John Doe",
"admin": true,
"iat": 1786636852,
"exp": 1786813252,
"jti": "a1b2c3d4"
}SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
A JSON Web Token (JWT) is a compact string used to transmit claims between parties — for example to keep a user logged in. It has three parts separated by dots: header.payload.signature. Each part is base64url encoded, which is why the token looks like random letters and numbers.
HS256, RS256…).sub (subject), exp (expiry), iat (issued at), aud (audience) and any custom data.Decoding runs entirely in your browser. Your token is never sent to any server and never stored.
A JSON Web Token is a three-part string (header.payload.signature) used to pass claims between systems, such as login sessions or API access. Each part is base64url-encoded JSON.
Yes. The header and payload are only encoded, not encrypted. Anyone can read them — which is exactly why you should never put passwords or sensitive data inside a token payload.
No. It decodes the three parts only. Verifying a signature requires the HMAC secret (HS256) or the public key (RS256 / ES256), which this free tool does not ask for.
No. Base64url is an encoding, not encryption. Anyone who obtains a token can read its header and payload. Use JWE for encryption, or keep sensitive data out of the payload.
A valid JWT must have exactly three parts separated by dots, and the header and payload must be valid base64url JSON. Check that you copied the full token, including the last dot and signature.
Yes — everything runs in your browser and nothing is uploaded. Still, avoid pasting tokens from production environments into any online tool as a general security habit.