JWT Decoder
EncodersNeed to decode a JSON Web Token? Our free online JWT Decoder lets you inspect the header, payload, and signature of any JWT instantly for easier debugging and security audits.
JWT Token
Decoded JSON
Need to decode a JSON Web Token? Our free online JWT Decoder lets you inspect the header, payload, and signature of any JWT instantly for easier debugging and security audits.
Search for a command to run...
Did You Know?
JWTs are Base64Url encoded, which removes characters like '+' and '/' to make them safe for URLs.
Best Practice
Never put sensitive secrets or passwords in a JWT payload, as anyone who sees the token can decode it.
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs consist of three distinct parts separated by dots: a Header (containing the algorithm), a Payload (containing the claims), and a Signature (verifying the sender's identity).
Tip
Always check the 'exp' (expiration) claim to ensure your sessions are not lasting longer than intended.
During the development of secure APIs, use this decoder to audit the 'Authorization: Bearer' headers sent by clients. By inspecting tokens manually, you can catch configuration errors in your auth middleware early. Remember that while this tool decodes information for visibility, your production environment must always cryptographically verify the token signature using your public or private keys to ensure data integrity.
Q: Is it safe to paste my JWT into this tool? A: Yes. The decoding happens locally in your browser using JavaScript. Your token data is not sent to our server.
Q: Can this tool tell me if a JWT is valid? A: This tool decodes the content so you can check claims like 'exp' (expiration), but it does not cryptographically verify the signature against a secret key.
Q: Why is my JWT payload appearing as gibberish? A: Ensure you have pasted the entire token including all three parts separated by dots. If it is still unreadable, it may be encrypted (JWE) rather than just signed (JWS).
Q: Does this tool store my tokens? A: No, Codemata does not log or store any data entered into our encoder/decoder tools.
Did You Know?
The three parts of a JWT are always separated by a period (.) character.