JWT Decoder

About this tool

This JWT decoder helps you read and understand JSON Web Tokens without sending them anywhere. Paste a token and the tool instantly splits it into the header, payload, and signature so you can see what is inside. It is useful when debugging authentication issues, inspecting access tokens, or verifying claims during development.

A JWT is a compact string made of three parts separated by dots. The header describes the signing algorithm, the payload contains claims such as user IDs or roles, and the signature proves the token has not been altered. The first two sections are Base64URL-encoded JSON, which means they are readable and not encrypted. This decoder simply converts that data back into readable JSON and formats it so it is easy to scan.

To use the tool, paste your JWT into the input box. The header and payload appear immediately, and the signature is listed as a separate block. If you want to verify the signature, select the algorithm and provide the secret or public key. The verifier recreates the signing input and checks it locally using your browser, so your token never leaves your device.

This page supports HS256 (HMAC with a shared secret) and RS256 (RSA public key verification). Other algorithms will still decode, but verification is marked as unsupported. Time-based claims such as exp, nbf, and iat are displayed with friendly status indicators so you can tell if a token is expired, not yet valid, or currently active.

Common use cases include checking login tokens in a web app, reviewing OAuth access tokens during API testing, troubleshooting “invalid token” errors, and confirming what permissions a token actually carries. Whether you need a JWT reader, a JSON Web Token decoder, or a quick way to inspect claims, this tool provides a safe, client-side option for fast analysis.

For sensitive tokens, you can save this page and run it offline. No network requests are made after the page loads, keeping your token data private.