JWT Decoder - Parse JSON Web Tokens Safely
Decode the header and payload of a JSON Web Token locally and understand what the signature does.
- No length limits
- No registration
- Free forever
- Your text never leaves your browser
The Three Parts of a JWT
A JSON Web Token is a compact string of three dot-separated segments: header.payload.signature. The header is a small JSON object that names the signing algorithm — usually HS256 or RS256 — and the token type. The payload holds the claims, statements about the subject such as sub, iss, aud, and exp, plus any custom fields the issuing application adds. The signature is computed over the encoded header and payload using a secret key (symmetric) or private key (asymmetric).
Each segment is encoded with Base64URL, a close cousin of Base64 that replaces “+” and “/” with “-” and “_” so the token is safe to place in URLs, and that drops the “=” padding. This page decodes the segments, pretty-prints the JSON in the header and payload, and shows the raw signature bytes. Reading those parts is only the first step, though — the next section explains why decoding alone proves nothing.
Decoding Is Not Verifying
The most important fact about JWTs is that decoding and verifying are different operations. Decoding simply unwraps the Base64URL and shows what the token says; anyone can do that to any token, because no secret is needed to read it. Verification is the security step: recomputing the signature with the correct key and confirming both that the token came from the server you trust and that it has not been altered in transit.
This page decodes only. Before an application accepts a token, the server must verify the signature with the algorithm and key it controls, then check the issuer, audience, and expiry claims and reject anything that fails. Never trust a token because its payload looks plausible, never accept the algorithm from the token itself, and never place secrets in the claims — the payload is readable by anyone who holds the token.
Frequently asked questions
Are JWTs encrypted?
No. A normal signed JWT is only encoded, so its header and payload are Base64URL text that anyone who receives the token can decode and read. That is why passwords, API keys, and personal data must never go into claims. Encryption is a separate, opt-in mechanism: a JWE (JSON Web Encryption) token encrypts its content so only the holder of the key can read it. Unless you are explicitly working with JWE, assume the token is public to whoever holds it, and rely on the signature for authenticity rather than for secrecy.
Your text never leaves your browser
Every tool runs locally on your device. Nothing you paste is uploaded, stored, or tracked.