OnlineDeveloperTool
Encoders & Decoders

JWT Decoder Online

Paste a JWT, see its header and payload as readable JSON.

Updated

This tool runs in your browser. No account or signup is required.

Common JWT Decoder tasks

Developers typically reach for this page when they need to decode JWT header and payload online; read JWT claims and expiry; inspect a JWT without verifying it. The tool is built for quick, practical work rather than a generic demo.

What matters in a jwt decoder workflow

When developers compare online tools for this job, the useful capabilities tend to center on header/payload, exp/iat/nbf, explicit non-verification warning, privacy. This page keeps those practical needs in mind while linking to related tools when a different workflow is a better fit.

What is JWT Decoder?

JWT Decoder splits a JSON Web Token into its three parts and shows the decoded header and payload. It does not verify the signature.

What problem does it solve?

Auth bugs often come down to what is inside a token: a wrong claim, an expired time, a missing role. Reading a JWT by hand means decoding Base64 pieces separately.

How to use JWT Decoder

  1. Paste the token (three parts separated by dots).
  2. Press Decode Token.
  3. Copy the header or payload.

Example

Input

header.payload.signature (a token starting with "ey...")

Output

Header:
{ "alg": "HS256", "typ": "JWT" }

Payload:
{ "sub": "1234567890", ... }

What you can do with JWT Decoder

  • Decode a JWT online
  • Read JWT claims
  • Inspect a token payload

Common use cases

  • Checking claims like sub, exp and roles while debugging auth
  • Making a test token for a local API
  • Explaining to a teammate what a token carries

Related developer tasks

  • Decode a JWT online
  • Read JWT claims
  • Inspect a token payload

Anatomy of a JWT

A JSON Web Token has three parts separated by dots: header.payload.signature. The header and payload are JSON that has been Base64URL-encoded.

The header usually names the signing algorithm (alg) and the token type (typ). The payload holds claims. Common registered claims include iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at) and jti (token ID).

Decoding is not verifying

Anyone can read the header and payload of a signed JWT, because they are only encoded, not encrypted. Decoding does not prove the token is genuine. Only checking the signature with the right key does that, and it belongs on your server.

For the same reason, never put secrets in a JWT payload, and never trust decoded claims without verifying the signature first.

Reading exp, nbf and iat

These claims are Unix timestamps in seconds. A value like 1516239022 is hard to read on sight; paste it into a timestamp converter to see the date.

Related: Timestamp Converter, Unix Timestamp, JWT Generator, Base64 Decoder

A note on real tokens

This decoder runs in your browser and the token is not uploaded for processing. Even so, a live token is a credential. Prefer expired or test tokens when you paste into any online tool.

JWT Decoder FAQ

Does it verify the signature?

No. Decoding only reads the header and payload. A decoded token is not proof the token is genuine.

Is a JWT payload secret?

No. The payload is only encoded, not encrypted, so anyone holding the token can read it. Do not put sensitive data in it.

Which algorithm does the generator use?

HS256 (HMAC-SHA256) with the secret you enter.

Can this tool verify the signature?

No. It decodes the header and payload only. Signature verification needs the signing key or public key.

Is a JWT encrypted?

A typical signed JWT is not encrypted. Its contents are readable by anyone who has the token. Encrypted tokens (JWE) are a different format.

What does the exp claim mean?

It is the expiry time as a Unix timestamp in seconds. After that moment a server should reject the token.

Is it safe to decode a JWT online?

Decoding here happens in your browser. Still, treat real tokens as credentials and use test or expired tokens when you can.

Looking for something else? Browse all developer tools.

onlinedevelopertool.com is a collection of 54 free, browser-based utilities for the small jobs that interrupt real work: formatting a JSON response, decoding a token, converting a timestamp, generating a UUID or checking a hash. Each tool has its own page with a short explanation, a worked example and answers to common questions, so you can use it and learn what it does at the same time.

There is no account to create and nothing to install. Tools run in your browser, so the text you paste is processed on your own device. The one exception is the Website Status Checker, which sends a request from your browser to the address you enter.

Three steps: paste your input, click the tool, copy the result, all inside your browser
Popular developer utilities: JWT decoder, UUID generator, Base64 decoder, SHA-256 hash, regex tester and timestamp converter

What you can do here

  • JSON Tools

    Format, validate, beautify and minify JSON, generate C#, TypeScript, Java, Python, Go, PHP and Kotlin models from it, or convert between JSON, YAML and CSV.

  • Encoders & Decoders

    URL, Base64 and HTML encoding and decoding, plus a JWT decoder for reading token claims.

  • Generators & Hashes

    Generate UUIDs and JWTs, validate UUIDs, and create MD5, SHA-256 and SHA-512 hashes.

  • Web Tools

    Timestamps, color codes, query strings and cron expressions - the small things web work keeps throwing at you.

  • Text & Data

    Format XML and YAML, count text, change case, make slugs, test regex, diff two texts and convert number bases.

  • Website Checking

    Check whether a website or URL is reachable from your browser.

Quick developer reference

  • JSON

    Keys and strings must use double quotes, and trailing commas and comments are not allowed. Those are the three most common reasons a payload fails to parse.

    Validate JSON

  • JWT

    A JSON Web Token is three Base64URL parts joined by dots: header, payload and signature. Decoding shows the claims but does not prove the token is genuine; only signature verification does.

    Decode a JWT

  • Base64

    Base64 is an encoding, not encryption. Anyone can reverse it, and it makes data roughly one third larger, so never use it to hide secrets.

    Decode Base64

  • UUID

    A version 4 UUID is made of random bits and written as 8-4-4-4-12 hexadecimal characters. Collisions are astronomically unlikely, which is why they work well as identifiers.

    Generate a UUID

  • Timestamps

    A Unix timestamp counts time since 1 January 1970 UTC. Ten digits usually means seconds and thirteen digits usually means milliseconds.

    Convert a timestamp

  • Hashes

    MD5 is fine for quick checksums but is not safe for security. Prefer SHA-256 or SHA-512, and remember that hashing is one-way and is not encryption.

    Create a SHA-256 hash

Missing a tool you need? Visit the contact page and tell us what you reach for most often. You can also browse every tool or read the About page to see how the site is built and what it does with your data.