Something wrong with this tool?
About JWT Decoder Online
This tool decodes a JSON Web Token (JWT) into its three constituent parts: header, payload, and signature. Paste a token from your application's auth flow, an Authorization header, or a cookie, and the tool returns the parsed JSON contents of the header and payload along with the raw signature bytes.
JWTs are widely used for authentication, session management, and API authorization. Decoding (not verifying) reveals what data the token carries — user ID, expiration time, scopes, custom claims — useful for debugging auth issues and confirming what your client actually sent.
Important: this tool decodes but does not verify signatures. A decoded JWT shows what the issuer claims, not whether those claims are authentic. For security checks, your server must verify the signature against the issuer's public key.
How to use this tool
How to inspect a JSON Web Token's header and payload
Paste the JWT
Drop the token into the "Token" field. JWTs look like `xxx.yyy.zzz` — three base64url segments separated by dots. The tool splits on dots and decodes the first two.
Press Run
Result returns `header` (the algorithm and type, e.g. `{ "alg": "HS256", "typ": "JWT" }`) and `payload` (your claims — `sub`, `exp`, `iat`, plus app-specific ones). The third segment (signature) is NOT verified or shown.
What this isn't
Decoding ≠ verifying. Anyone with the token can read its payload; what proves authenticity is the signature, which requires the secret/public key. Don't trust unsigned tokens — use jwt-encoder or your auth library to verify on a server you control.
Common claims worth checking
`exp` is a Unix timestamp — expired tokens shouldn't be honored even if the signature is valid. `iss` should match your expected issuer. `aud` should match your service. If a token's payload looks fine but auth fails, the signature is wrong, not the claims.