JWT Decoder - Decode & Inspect JSON Web Tokens Online

Paste a JWT and see exactly what's inside it

Got a JWT (JSON Web Token) and need to know what claims it carries, when it expires, or which algorithm signed it? Paste the token above and this JWT decoder breaks it apart in one click — readable header, full payload, and signature info, right in your browser.

Your token never leaves your device. All decoding and optional signature verification happen entirely client-side, so there's nothing to worry about with sensitive tokens from production systems.

How to use this JWT decoder

1. Copy your JWT — it looks like three Base64URL chunks joined by dots, e.g. eyJ....
2. Paste it into the input field above and click Decode (or it decodes automatically as you type).
3. Read the output — the header and payload panels show the decoded JSON. The signature section tells you the algorithm used.
4. Verify the signature (optional) — supply your secret (for HS256) or public key (for RS256 / ES256) to confirm the token is genuine.

Worked example

Here's a real-looking JWT (trimmed for readability):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsIm5hbWUiOiJBbGljZSBTbWl0aCIsImlhdCI6MTcxNTAwMDAwMCwiZXhwIjoxNzE1MDg2NDAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

After pasting it, the decoder shows three clean panels:

At a glance you can see the token belongs to Alice, was issued at a specific Unix timestamp, and expires 24 hours later.

How to decode a JWT in code

The online tool is the fastest way to inspect a token, but here's how to do the same thing programmatically when you need it in a script or service.

JavaScript (Node.js)

// npm install jsonwebtoken
const jwt = require('jsonwebtoken');

const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...';

// Decode WITHOUT verifying the signature (inspect only)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header);   // { alg: 'HS256', typ: 'JWT' }
console.log(decoded.payload);  // { sub: 'user_123', name: 'Alice Smith', ... }

// Decode AND verify (requires the secret)
const verified = jwt.verify(token, 'your-secret-key');
console.log(verified); // payload object, or throws if invalid

Python

# pip install PyJWT
import jwt

token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'

# Decode WITHOUT verifying (inspect only)
decoded = jwt.decode(token, options={'verify_signature': False}, algorithms=['HS256'])
print(decoded)  # {'sub': 'user_123', 'name': 'Alice Smith', ...}

# Decode AND verify (requires the secret)
verified = jwt.decode(token, 'your-secret-key', algorithms=['HS256'])
print(verified)

Both snippets use well-maintained libraries: jsonwebtoken for Node and PyJWT for Python.

How JWT decoding works

A JWT has three dot-separated parts: header.payload.signature. The header and payload are just Base64URL-encoded JSON — a simple encoding, not encryption. Any tool (or person) can decode them instantly without a key.

The signature is different. It's a cryptographic hash of the header and payload, created with a secret or private key. You need the matching secret or public key to verify that hash — but you don't need it just to read the claims.

Two common signing algorithms:

• HS256 — HMAC with SHA-256. Uses a single shared secret that both the issuer and verifier must know. Simple, but the secret must stay private on both sides.
• RS256 / ES256 — Asymmetric algorithms (RSA or Elliptic Curve). The issuer signs with a private key; anyone can verify with the matching public key. Common in federated identity (OAuth 2.0, OpenID Connect).

The relevant standard is RFC 7519 (JWT), published by the IETF.

JWT claims — what each field actually means

The payload is a JSON object whose keys are called claims. The spec defines a set of registered claims — short, standardised names every system understands:

Any other keys in the payload are custom (private) claims your application defines, such as role, email, or permissions.

⚠️ JWTs are signed, not encrypted — never put secrets in the payload

This is one of the most common JWT mistakes. Because the payload is only Base64URL-encoded, anyone who holds the token can read every claim — no key required. The signature only proves the token wasn't tampered with; it doesn't hide the contents.

Never store passwords, credit card numbers, or any sensitive data in a JWT payload. Use a short expiry (exp) and keep your signing secret or private key safe.

When to use this tool — and when not to

Great for:

• Quickly inspecting a token during API development or debugging an auth flow.
• Checking the exp claim to see if a token has expired.
• Confirming which algorithm and kid (key ID) a token uses before setting up verification.
• Teaching yourself or a teammate what a real JWT looks like inside.

Not the right tool when:

• You need to generate or sign new tokens — use a server-side JWT library for that.
• You're working with JWE (JSON Web Encryption) — an encrypted token whose payload you can't read without the private key. This tool handles signed JWTs (JWS), not encrypted ones.
• You need bulk or automated token inspection — write a script using one of the code snippets above instead.

Everything runs in your browser, so your token stays completely private — nothing is sent to any server. Paste a token above and get your answer in seconds.