JWT Decoder
Decode JWT tokens and view payload data online free — inspect JSON Web Token headers, claims, and signatures instantly.
Last updated: 10 October 2026
Decode a JWT into its header, payload and signature sections with readable JSON — no verification, pure inspection. A standard HS256 token separated into its three segments with claims sub, name and iat parsed correctly.
JWT Decoder
About JWT:
JSON Web Tokens (JWT) consist of three Base64URL-encoded parts separated by dots: header, payload, and signature. This tool decodes the header and payload for inspection. The signature is shown in hexadecimal format. Note: this tool does not verify the signature.
Worked Examples
Tested token
- Standard HS256 JWT → three segments parsed: header, payload, signature
- Header showed alg HS256 and typ JWT; payload showed sub, name and iat claims
- Signature segment displays as Base64 — decoding it does not verify it
Reading the claims
- iat is issued-at, exp is expiry — both in Unix seconds.
- This tool never validates the signature; only your server can do that with the secret.
- Paste production tokens carefully: payloads are readable by anyone, so never put secrets in them.
About JWT Decoder
Decode JWT (JSON Web Token) tokens and view their header, payload, and signature segments. Paste a complete JWT and instantly see the parsed JSON in each section. Useful for debugging API authentication, inspecting token claims, and understanding JWT structure. Test data: decoding a standard HS256 JWT produced three correctly separated segments — the header {alg:HS256, typ:JWT}, the payload {sub:1234567890, name:'John Doe', iat:1516239022}, and the signature — all parsed and formatted as readable JSON.
Limits: Does not verify cryptographic signatures — decode only; Cannot decrypt JWE (encrypted JWT) tokens; Cannot check if a token has been revoked or expired against an auth server; Very large payloads (10KB+) may display slowly in the formatted view; Does not validate token structure beyond basic three-segment parsing
Who Uses This Tool
- A backend developer debugging an authentication flow by inspecting the claims in a token returned by their OAuth provider
- A QA engineer verifying that a JWT issued by a login endpoint contains the correct user ID and role claims
- A security researcher examining tokens captured from API traffic to understand what data is being transmitted
Key Features
- Decode header, payload, and signature segments
- Formatted and syntax-highlighted JSON output
- Instant decoding — no server upload
- Shows token expiration time if present
- Supports HS256, HS384, HS512, RS256, and ES256 encoded tokens
How to use JWT Decoder
- Paste your complete JWT token (with all three dot-separated segments).
- View the decoded header (algorithm and token type) at the top.
- View the decoded payload (claims and data) in the middle.
- View the Base64-encoded signature at the bottom.
How It Compares
Unlike jwt.io which is the industry standard but requires pasting tokens into a third-party site, this tool processes entirely in your browser with zero network transmission. It also provides cleaner formatted JSON output than debugger.jwt.io's default view.
Privacy & Security
Because processing happens directly in your browser, your files and input are not uploaded to our servers.
Written and checked by Mohammad Sohail
Token parsing re-checked on 10 October 2026 with a standard HS256 JWT.
About FreeDigitalToolkit →Frequently Asked Questions
What is a JWT?
JWT (JSON Web Token) is a compact, URL-safe token format for transmitting claims between parties. It consists of three Base64URL-encoded segments separated by dots: header, payload, and signature. It's the standard for API authentication and authorization.
Does this verify the signature?
No. This tool only decodes the JWT content — it does not verify the cryptographic signature or check token expiration. Never paste production authentication tokens containing sensitive user data into any online tool.
Why does my JWT look garbled after decoding?
The payload is Base64URL-encoded, not encrypted. If the payload appears as random characters, it might be a JWE (encrypted token) rather than a JWS (signed token). JWE tokens cannot be decoded without the encryption key.
What do common JWT claims like 'exp' and 'iat' mean?
'iat' is 'issued at' (Unix timestamp when the token was created), 'exp' is 'expiration' (when the token expires), 'sub' is 'subject' (who the token is about), and 'iss' is 'issuer' (who created the token).
Can I use this to test JWT authentication in my app?
Yes. Paste the token your API returns and verify the claims match what you expect. Check that 'exp' is in the future, 'sub' contains the correct user ID, and any custom claims are present. Then use a separate tool or your backend to verify the signature.
Related Tools
Browse all Security Tools or explore our full collection of 86 free tools.