Decode a JSON Web Token online
A JSON Web Token (JWT) is a compact, URL-safe string made of three Base64url parts separated by dots — a header, a payload, and a signature. The header and payload are only encoded, not encrypted, so their contents can be read by anyone. This free JWT decoder splits a token apart and pretty-prints the header and payload so you can inspect the claims inside, read the algorithm, and check when the token expires.
How to decode a JWT
- Paste your token — it usually starts with
eyJ— into the JWT box. - The decoded Header and Payload appear instantly in separate panels.
- Review the parsed claims, including issued-at, expiry, and issuer, to see whether the token is still valid.
Common uses for a JWT debugger
- Debugging authentication flows by confirming which claims a login endpoint actually returns.
- Checking a token's
expclaim to diagnose "session expired" and 401 errors. - Reading the
algandkidheader fields while wiring up token verification. - Inspecting scopes, roles, and audience values during API integration.
Decoding is not verification
This tool decodes the header and payload for inspection only — it does not verify the signature, which requires the issuer's secret or public key. A decoded token proves what a JWT claims, not that the claim is trustworthy, so never treat decoded contents as authenticated. Because a JWT is not encrypted, avoid putting sensitive data in the payload.
Nothing is uploaded
Your token is decoded entirely in your browser with JavaScript — it is never sent to, logged by, or stored on our servers, so it is safe to inspect real tokens. Want to work with the raw segments yourself? Each part is Base64url, which you can convert with our Base64 encoder and decoder, and you can tidy up the decoded claims with the JSON formatter.
Need a custom tool or internal developer utility built for your team? Get in touch with SR Infobiz.