JWT Decoder

What is JWT Decoder?

Paste a JWT (JSON Web Token) and instantly see its decoded header and payload as readable JSON. This only decodes the token's Base64URL-encoded segments; it doesn't verify the signature, since that requires the secret or public key used to sign it.

How to Use the JWT Decoder

1. 1

   Paste the JWT: Enter the full token, including all three dot-separated parts.

2. 2

   Read the Decoded Header and Payload: The readable JSON for both segments appears automatically.

Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

// Header
{
  "alg": "HS256",
  "typ": "JWT"
}

// Payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

A JWT is three dot-separated, Base64URL-encoded parts (header, payload, signature) — decoding reveals the first two. The third (the signature) is raw cryptographic bytes, not readable JSON, which is why this tool intentionally never attempts to show or verify it.

Header, Payload, Signature: Decoding vs. Verifying

The header names the signing algorithm and token type. The payload carries the actual claims: who the token represents (sub), when it was issued (iat), and any other data the issuer chose to include. None of this is encrypted, just encoded, so a JWT should never be used to carry secrets. The signature is what makes the token trustworthy: it lets whoever holds the signing secret (or, for asymmetric algorithms, the public key) confirm the header and payload haven't been tampered with since the token was issued. Decoding, which is all this tool does, just reverses the Base64URL encoding on the header and payload to show their contents. Anyone can do this with no special access, since no secret is involved. Verifying is a different operation entirely: it recomputes the signature using the secret or public key and checks it matches the token's third segment. A token can decode perfectly and still be invalid: expired, tampered with, or signed by the wrong party. That's exactly why this tool never claims a decoded token is trustworthy, only that it's readable.