JWT Decoder
Decode a JWT header and payload in your browser as you type. The signature is displayed but not verified. Invalid tokens are not saved.
Enter JWT Token
Paste your JWT token below (header.payload.signature). Header, payload, and signature update as you type.
Quick Examples
Try one of the sample tokens below to see how it works.
Decoded JWT
Paste a JWT to decode the header and payload.
Need to verify your token?
This page decodes and displays the contents of a JWT. Signature verification needs a secret or public key and is not performed here. A successful decode means the token parsed, not that it is trusted.
Your data stays private
Tokens are decoded locally. Invalid input is not saved. Nothing is uploaded or stored on a server.
About decoding JWTs in the browser
A JSON Web Token is three Base64URL segments: header, payload, and signature, joined by dots. Decoding is not verification. Anyone can read the payload of a typical HS256 token; the signature only proves that someone who knew the secret produced it. This page parses the first two segments with a Base64URL decoder and JSON.parse, then pretty-prints header, payload, and the raw signature string. It never sends the token to a server and it never checks HMAC or RSA.
Use it when you have a token from an Authorization header and you want to see exp, sub, or alg without pasting into a third-party decoder. Do not treat a successful decode as “this token is trusted.” Unsigned tokens (empty signature) still decode. Invalid Base64 or non-JSON payloads show an error. We only write a token to session storage after it decodes successfully, so a half-typed invalid JWT is not kept.
Quick Examples load a valid Ada token, an expired exp, garbage that cannot parse, and a custom claim set with role and tenant. JSON updates as you type. Related: JWT Encoder to mint HS256/384/512 tokens with a secret that stays in this tab. HMAC Generator if you need a raw keyed digest rather than a JWT.
How to decode a JWT
Paste the token
Three Base64URL parts separated by dots. Load a sample token or pick a Quick Example if you only need a walkthrough.
Read header and payload
Pretty JSON updates as you type. alg, typ, sub, and exp are in the object, not verified. An expired exp still decodes.
Copy the JSON
Copy header, payload, or signature from each block. The decoded card updates as soon as the token parses.
Do not upload secrets
If the token is a session, close the tab when you are done. We do not verify signatures.
Related tools
JWT Encoder
Sign an HS256, HS384, or HS512 JWT locally from a JSON payload and secret.
HMAC Generator
Generate HMAC (Hash-based Message Authentication Code) using various algorithms. HMAC is commonly used to verify the integrity and authenticity of messages.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, or SHA-512 hashes using various encodings. Hashing is commonly used to verify integrity and fingerprint data.
Base64 Decode
Decode Base64 text back to UTF-8. Type or paste below — the result updates as you type.
UUID Generator
Generate UUIDs instantly in your browser. Free, private, and no signup required.
Bcrypt Hash / Verify
Hash a password with bcrypt, or verify a password against an existing hash — locally in your browser.
JWT Decoder FAQ
No. This page Base64URL-decodes the header and payload and pretty-prints them. The signature string is shown as text. Anyone can read a typical HS256 payload; verification would need the secret or public key and is not performed here. Treat a successful decode as “the token parsed,” not “the token is trusted.” Unsigned tokens (empty third segment) still decode.
We only write to session storage after a token decodes successfully. A half-typed or corrupt JWT is not kept, so a refresh starts from empty (or the last valid token). Paste a complete three-part token, or use Load sample token / Quick Examples. Invalid Base64 or a non-JSON payload shows an error instead of JSON.
No. Decoding runs in this tab. Close the page to clear a valid token from session storage for this origin. Do not paste production session tokens on a shared computer. Related: JWT Encoder to mint HS256/384/512 locally; HMAC Generator for a raw keyed digest.