JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe token format used to securely transmit information between parties. It consists of three base64url-encoded sections separated by dots:

JWTs are widely used in API authentication — when you log in to an app, a JWT is issued and sent with every subsequent request to prove your identity. The payload is only base64-encoded, not encrypted, so never put sensitive data (passwords, secrets) in a JWT payload.

JSON Web Tokens (JWTs) are everywhere in modern authentication — they power login sessions, API authorization, and microservices communication. When something goes wrong with authentication, being able to quickly inspect what's inside a JWT is invaluable. Our JWT Decoder decodes any JWT instantly in your browser, shows all three segments decoded, and verifies signatures.

Paste any JWT into the input field and it instantly decodes all three sections: the header (algorithm and token type), the payload (claims, user data, expiration), and the signature. If you have the signing secret or public key, enter it to verify the signature. Expiration times are shown in human-readable format with a clear expired or valid indicator.

Common uses include debugging authentication failures by inspecting token claims, checking token expiration without writing code, verifying that the correct user ID is in a token's payload during development, inspecting third-party JWTs, and auditing token contents before trusting them in a new integration.

Most JWT decoder tools decode the token but don't verify the signature. Ours verifies HMAC signatures (HS256, HS384, HS512) when you provide the secret, and RSA signatures (RS256, RS384, RS512) when you provide the public key. Everything runs locally — your JWT is never sent to any server. Free, no signup required.