JWT Decoder Online (JSON Web Token)

Decode JSON Web Tokens (JWT) locally in your browser. This tool parses the header and payload of your token without transmitting any data to a server. Important: This tool only decodes the token. It does not verify the cryptographic signature or validate the authenticity of the token. Decoding is not verification.

A standard JSON Web Token is a compact URL-safe means of representing claims to be transferred between two parties. It consists of three parts separated by dots (`.`): the Header, the Payload, and the Signature. The Header typically consists of two parts: the type of the token (JWT) and the signing algorithm being used, such as HMAC SHA256 or RSA. The Payload contains the claims, which are statements about an entity (typically, the user) and additional data. Finally, the Signature is used to verify the message wasn't changed along the way.

The Header and Payload of a JWT are encoded using Base64URL encoding (a variant of Base64 that uses `-` instead of `+` and `_` instead of `/`, making it safe for HTTP URLs). This tool reverses that encoding to reveal the underlying JSON data. It seamlessly parses standard registered claims like `alg` (Algorithm), `typ` (Token Type), `iat` (Issued At), `exp` (Expiration Time), `sub` (Subject), and `iss` (Issuer). Because the data is merely encoded and not encrypted, anyone who intercepts the token can decode and read the information inside.

It is critical to distinguish between decoding a token and verifying a token. Modifying the decoded payload does not magically create a valid token, because the trailing Signature will no longer match the altered payload. A decoded payload should never be trusted until the token's signature is cryptographically verified on a secure backend server using the appropriate secret or public key. This tool is designed purely for debugging and inspecting token contents locally, not for validating issuer authenticity or audience expiration.

Authentication tokens often contain sensitive session identifiers, PII (Personally Identifiable Information), and authorization roles. Pasting live tokens into random internet tools can expose your infrastructure to severe security breaches. We process your token locally using native browser APIs (`atob` and `decodeURIComponent`). If the token is malformed, the decoder will fail safely without sending the broken token anywhere. Your token never leaves your device's memory.