JWT Decoder Online

JWT Input

Chars: 0

Client-side only · does not verify signatures

Decoded JWT

Decoded header & payload will appear here

Paste a compact JWT on the left. Decoding stays in your browser and does not verify signatures.

Public jwt.io documentation sample (HS256, not for production)

Decoding runs entirely in your browser. Tokens are never uploaded to our servers. This tool does not verify signatures — treat decoded claims as untrusted until you validate them with your own key or JWKS.

How to Use This JWT Decoder

Paste a compact token, read the header and payload as JSON, and remember: this page does not verify signatures.

Step 1 – Paste a Compact JWT

Drop a three-part token into the left panel (optional Bearer prefix is fine). If you only have the payload JSON already, open the JSON viewer instead.

🔐

Compact form - header.payload.signature Base64URL segments.

🧹

Bearer strip - Authorization header values are accepted.

Example JWT (jwt.io sample)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Step 2 – Inspect Header and Payload

The right panel shows pretty-printed JSON for header and payload plus the raw signature string. alg and typ appear in the status bar when present.

📦

Claims - Payload keys stay as JSON numbers, strings and objects.

⚠️

No verify - Signature is displayed only — never checked.

Decoded structure

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "signature": "SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "note": "Signature shown as Base64URL only — this tool does not verify signatures."
}

Step 3 – Copy or Keep Working Locally

Copy the decoded JSON for notes or debugging. Validate the token with your IdP or a server library before trusting any claim in production.

📎

Clipboard - Copies the combined decoded JSON.

🔒

Local only - Nothing leaves the browser tab.

⚡Export the decoded JWT JSON

2 Actions

📎

Clipboard

Copy decoded JSON

👀

Inspect

Check alg / claims locally

💡Tip: never paste production secrets into shared screenshots.

JWT Anatomy in Three Segments

What this decoder reads from a compact token.

Segment → decoded view

Part	What you see
Header (1st segment)	`Base64URL → JSON object (alg, typ, kid, …)`
Payload (2nd segment)	`Base64URL → JSON object (claims)`
Signature (3rd segment)	`Raw Base64URL string — not verified`

JWT Decoder FAQs

JWT decoder questions about Base64URL, signatures, Bearer tokens and privacy

How do I decode a JWT online?

Paste a compact JWT (three Base64URL segments separated by dots) into the left editor. The tool Base64URL-decodes the header and payload into pretty JSON and shows the signature segment as raw text.

Does this JWT decoder verify signatures?

No. It deliberately does not verify signatures. Use it to inspect claims locally, then validate the token with your identity provider, a JWKS endpoint, or a server-side library before trusting any claim.

What happens if the token is invalid?

You get a friendly error: wrong segment count, illegal Base64URL characters, non-UTF-8 bytes, or header/payload JSON that is not an object. Fix the token and try again — nothing is sent anywhere.

Can I paste a Bearer token from Authorization headers?

Yes. An optional leading "Bearer " prefix is stripped before parsing so you can paste the full Authorization header value.

Are exp / iat shown as dates?

Numeric claim values stay as JSON numbers in the decoded payload. Convert Unix seconds to dates in your own tooling if you need human-readable timestamps.

Is the sample token safe?

The Load Sample button uses the public jwt.io documentation example. Its signature is for demonstration only and must not be used as a production secret.

How is this different from a JSON viewer?

A JSON viewer expects already-decoded JSON. This page splits a compact JWT, decodes Base64URL segments, and labels header vs payload vs signature. For plain JSON, use /json-viewer or /json-beautifier.

Does pasting upload my token?

No. Header and payload Base64URL decoding happens in the browser only. Nothing is posted to /api or stored. The signature segment is displayed as-is and is never checked against a secret or public key.

JSON EDITOR

Edit, format, and beautify JSON

JSON VALIDATOR

Validate, fix, and inspect JSON

JSON ANALYZER

Compare, measure, and map JSON

EXPORT & SHARE

Convert JSON to other formats

IMPORT TO JSON

Convert other formats to JSON

XML TOOLS

Convert, format, fix, and minify XML

CODE & FORMATTERS

Generate code and format other languages

How to Use This JWT Decoder

Step 1 – Paste a Compact JWT

Step 2 – Inspect Header and Payload

Step 3 – Copy or Keep Working Locally

JWT Anatomy in Three Segments

Base64URL, not Base64

Claims stay untrusted

Why This Tool Does Not Verify Signatures

No private keys in the browser

Use your IdP for trust

alg=none is still dangerous

Common Debugging Workflows

Expired session checks

Wrong audience or issuer

Nested JSON claims

Related Tools Beside JWT Decoder

Pretty-print claims

Explore structure

Fix broken claim strings