JWT Decoder - View Token Payload & Header

A JWT decoder parses JSON Web Tokens and displays the header and payload as readable JSON. JWTs encode user claims, permissions, and metadata for APIs and authentication systems. Use this tool to inspect tokens during development or debugging without installing libraries.

1. Paste the token: Enter the full JWT string (three base64url-encoded segments separated by dots).
2. Decode: Click Decode to view the header and payload.
3. Review claims: Check expiration, issuer, and custom claims in plain JSON.

• Quick inspection: See what's inside a token without writing code.
• Debug auth issues: Verify claims like exp, iat, and sub match expectations.
• Learn JWT structure: Understand header algorithms and payload anatomy.

Use case 1: Auth debugging

Decode access tokens to confirm the user ID, roles, and expiration are correct before calling APIs.

Use case 2: API integration

Inspect third-party tokens to understand what claims they provide and how to validate them.

Use case 3: Security review

Check token headers for algorithm confusion attacks (e.g., alg: "none") during audits.

Basic example

Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.Gfx6VO9tcxwk6xqx9yYzSfebfeakZp5JYIgP_edcw_A
Header:

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:

{
  "sub": "1234567890",
  "name": "John Doe"
}

Advanced example

Token with expiration and custom claims: Payload shows iat, exp, and any app-specific fields like roles or tenant_id.

Invalid token format

JWTs have exactly three segments. If you see an error, check that the full token (including all three parts) was pasted.

Expired tokens

A decoded token may have an exp claim in the past. Decode still works, but the token is no longer valid for API calls.

• Decoding reveals payload content but doesn't verify the signature; verification requires the secret or public key.
• For tokens with long payloads, format the JSON using the JSON formatter.
• Check exp timestamps by converting epoch seconds to dates in your timezone.

• Format decoded JSON with the JSON formatter.
• Encode payloads with the Base64 encoder.
• Hash values with the SHA generator.

Decoding happens locally in your browser. No tokens are uploaded, so session keys and user data stay private. Avoid pasting production tokens with sensitive claims in shared environments.