JWT decoder · Guide
JWT Decoder Online: Inspect Header and Payload
A JWT decoder online splits a token into its parts and shows the header and payload as readable JSON. This guide explains what a decoder does, what it deliberately does not do, and how to use it for auth debugging.
What a decoder reveals
A JWT has three Base64url parts separated by dots: header, payload and signature. A decoder Base64url-decodes the first two and pretty-prints them, so you can read the algorithm, the claims, the subject and the expiry at a glance.
This runs entirely in your browser. The token is never sent anywhere, which matters because tokens often grant real access.
Decoding is not verifying
A decoder reads the claims; it does not check the signature. Anyone can decode a JWT — that is by design, since the payload is not secret. To confirm a token is genuine you need to verify the signature against the secret or key, which is a separate step.
Use it for debugging
When an API rejects a token, decoding it is the first move: check the expiry, confirm the audience and issuer, and make sure the claims your code reads are actually present.
Frequently asked questions
Do I need the secret to decode a JWT?
No. The header and payload are only Base64url-encoded, not encrypted, so they decode without any secret. The secret is only needed to verify the signature.
Is it safe to paste a token here?
The decoder works entirely in your browser and does not upload the token. Still, treat production tokens with care and avoid pasting them into tools you do not trust.
Ready to try it?
Open the free browser-based JWT decoder and apply what you just read — no sign-up, runs locally.
Open the JWT decoder tool