JWT decoder

Read a JWT’s JSON header and payload locally without sending the token elsewhere.

Inspect a JWT header and payload in your browser. Decoding does not verify the signature or prove that a token is valid.

Result

Enter your data and run the tool. Your result will appear here.

The values you enter stay on this page. Reloading or closing it clears them.

We count which tools are used most, without including entered values or file contents in the statistics. Privacy

When a JWT decoder helps

Use it when debugging applications and integrations to see which fields a token contains. A signed JWT can have a readable payload: base64url encoding and encryption are different operations.

Decode the token step by step

Paste the token itself without the Bearer prefix.
Choose Decode to inspect the two JSON objects.
Compare claims with your application’s expectations; use the timestamp converter in seconds for an exp date.

How the header and payload are read

The engine requires three dot-separated parts. It decodes the header and payload from base64url to UTF-8, checks that they are JSON objects and formats them. The third part is not verified; an empty signature may still be syntactically accepted.

Interpret claims as unverified data

The output contains header and payload fields. Their names and values are claims made by the token and may have been altered. A readable exp date establishes neither authenticity nor authorization.

Claims declared in the payload
Field	General meaning
sub	Subject identifier
exp	Declared expiry in Unix seconds
iss / aud	Intended issuer and audience

Example using a demonstration token

An unsigned token for learning the format

Input: eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIiwiZXhwIjoxNzA0MDY3MjAwfQ.
Result: {"header":{"alg":"none"},"payload":{"sub":"demo","exp":1704067200}}

The example uses alg=none and an empty signature. It displays sub=demo and exp=1704067200, meaning 1 January 2024 at 00:00 UTC. The decoder displays this value without deciding whether the token has expired.

Limits and checks the decoder does not perform

The limit is 16,000 characters. Five-part encrypted JWE tokens and payloads that are not JSON objects are unsupported. Values stay in the page until it reloads and are not sent to the conversion service. Claims are displayed as text, without executing embedded HTML.

Sources and further reading

Frequently asked questions

Does readable output mean I can allow access?

No. The application must verify the signature, permitted algorithm, issuer, audience and time constraints under its protocol. This decoder does not perform those checks.

Why can’t I open an encrypted token?

A JWE needs decryption and the appropriate keys. This tool only reads the three-part compact format and does not decrypt tokens.

JWT decoder

Set your data

Result

When a JWT decoder helps

Decode the token step by step

How the header and payload are read

Interpret claims as unverified data

Example using a demonstration token

An unsigned token for learning the format

Limits and checks the decoder does not perform

Sources and further reading

Frequently asked questions

Favorites

JWT decoder

Set your data

Result

When a JWT decoder helps

Decode the token step by step

How the header and payload are read

Interpret claims as unverified data

Example using a demonstration token

An unsigned token for learning the format

Limits and checks the decoder does not perform

Sources and further reading

Frequently asked questions

You might also need

Unix timestamp converter

JSON formatter

Base64 converter