JWT Decoder, Runs Locally in Your Browser

A JSON Web Token looks like an unreadable string of random characters, but it is actually three separate pieces of base64url encoded JSON stitched together with periods: a header, a payload, and a signature. Debugging an authentication flow, inspecting what claims a session actually contains, or checking why a token is being rejected almost always starts with the same step, decoding the token to see what is inside it. This tool does exactly that, instantly, entirely in your browser, and formats both the header and payload as clean, readable JSON.

What a JWT actually is, structurally

Per the JWT specification, RFC 7519, a JSON Web Token is made of three dot separated segments. The first is the header, typically containing the signing algorithm and token type. The second is the payload, containing the actual claims, information about the user or session, such as who issued the token, who it is for, and when it expires. The third is the signature, a cryptographic value computed from the first two segments using a secret or private key, used to verify the token has not been tampered with. This tool decodes the first two segments and displays the third as-is, since the signature itself is not human readable JSON, it is a raw cryptographic value.

Encoded is not the same as encrypted

This is the single most important thing to understand about a JWT: the header and payload are base64url encoded, not encrypted. Encoding is reversible by design, anyone with the token, not just the server that issued it, can decode the header and payload and read the claims inside, exactly what this tool does. This is why a JWT should never be used to store secret information directly in its payload, a password, a private key, or anything else that should not be visible to whoever holds the token. If you need to inspect a token's claims for debugging, decoding it locally like this is completely normal and expected, the token was never confidential to begin with.

Standard claims this tool highlights

Beyond showing the raw decoded JSON, this tool recognizes the standard registered claim names defined in RFC 7519, iss for issuer, sub for subject, aud for audience, exp for expiration time, nbf for not before, iat for issued at, and jti for JWT ID, and surfaces them in a separate, plainly labeled summary. Timestamp claims like exp, iat, and nbf are stored as Unix time, seconds since 1970, which is not human readable on its own, so this tool converts them into a readable date and time automatically. If a token's exp claim has already passed, it is flagged directly, since a token that has technically expired is often the actual reason behind a confusing authentication failure.

What this tool deliberately does not do

This tool decodes a token's header and payload, it does not verify the signature. Verifying a signature requires the secret key, for symmetric algorithms like HS256, or the public key, for asymmetric algorithms like RS256, that the issuing server used to sign the token in the first place, information this tool has no access to and should not ask for. A decoded payload tells you what a token claims about itself, not whether those claims can be trusted as authentic, that trust only comes from successful signature verification against the correct key, which is properly a server side responsibility, not something to hand to a general purpose browser tool.

Safe to use with real tokens, by design

Because decoding a JWT reveals no more than what is already technically readable by anyone holding the token, and because this tool performs that decoding entirely client side with no network request involved, it is reasonably safe to paste a real session token here while debugging. Nothing you paste is transmitted, logged, or stored anywhere. As a general practice across any third party tool, it is still worth avoiding pasting production tokens when a sanitized or locally generated test token would answer the same question, simply as a matter of good habit rather than a specific risk unique to this tool.

Part of the developer utilities collection

If the token you are debugging came from a request or response body rather than an Authorization header, our JSON Formatter is useful for cleaning up the surrounding payload, and if you need to generate fresh identifiers or test values while working through an auth flow, our UUID Generator is part of the same Developer Utilities collection this tool belongs to.