JWT Decoder: Decode JSON Web Token Header & Payload

Read Inside Any JSON Web Token in Seconds

A JWT decoder lets you peek inside a JSON Web Token without writing a single line of code. JWTs are everywhere in modern web apps — they carry login sessions, API authorization, and identity claims between services. But because a token looks like one long blob of random characters, debugging an auth problem can feel like reading static. This tool turns that blob into clean, readable JSON so you can see exactly what your backend is sending.

What This Tool Does

Paste a token in the header.payload.signature format and the decoder splits it on the dots into three parts. It takes the first two segments, reverses the base64url encoding (swapping - and _ back to + and /, re-adding = padding), decodes the bytes as UTF-8, and runs JSON.parse on the result. The header and payload are then pretty-printed with indentation so nested claims are easy to scan. The signature is shown exactly as-is, because it is a raw cryptographic value, not JSON. If any segment is malformed, you get a clear error instead of a crash.

A Worked Example

Suppose you paste this token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.abc123

The first segment decodes to the header:

{
  "alg": "HS256",
  "typ": "JWT"
}

The second decodes to the payload:

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1516239022
}

Here iat (issued at) is 1516239022. The decoder converts that Unix timestamp into a readable date — Thu, 18 Jan 2018 01:30:22 UTC — so you instantly know when the token was minted. If an exp claim were present, the tool would do the same and tell you whether it has already expired.

When Developers Reach For It

Engineers use a JWT decoder constantly while building and debugging authentication:

• Diagnosing 401s — confirm the exp claim has not lapsed, or that nbf (not before) is in the past.
• Checking claims — verify that roles, scopes, tenant IDs, or a sub are present and correct before blaming the API.
• Comparing environments — see why a token works in staging but not production by diffing the decoded payloads.
• Learning the format — understand how alg, kid, and custom claims are laid out without reading the RFC.

Decode Is Not Verify

This is the single most important caveat: decoding only reads the data, it does not prove the token is authentic. The signature exists to detect tampering, and checking it requires the issuer's secret or public key. This tool intentionally never verifies — so do not make trust decisions based on decoded contents, and never paste a live production token or secret. Treat anything you decode as already exposed.

Private by Design

All of the splitting, base64url decoding, and JSON parsing happens in your browser with JavaScript. Nothing is uploaded to a server, nothing is logged, and the page works offline once the page has loaded. That makes it safe for inspecting test tokens during local development, on a flaky connection, or while working with internal tokens you would never want to send to a third-party website. The decoding is also UTF-8 safe, so payloads containing accented names or non-Latin characters render correctly rather than turning into mojibake.

Need to tidy the JSON you copy out, or count its length for a header limit? Pair this with the text case converter for quick reformatting and the word & character counter when a token or claim must fit a size budget.