Looking to inspect the contents of a JSON Web Token? Our free online JWT Decoder lets you instantly view the header, payload, and signature sections of any JWT for easier debugging and authentication testing.
Search for a command to run...
Best Practice
Never include sensitive data like passwords or private keys in a JWT payload; it is only encoded, not encrypted.
Did You Know?
A JWT consists of three parts separated by dots: Header, Payload, and Signature.
JSON Web Tokens (JWT) are an open, industry-standard RFC 7519 method for representing claims securely between two parties. They are widely used in modern web development for authentication (AuthN) and authorization (AuthZ). A JWT is essentially a string composed of three parts: a header, a payload, and a signature. Because these parts are Base64Url encoded, they are not human-readable at a glance, making a dedicated decoder tool essential for developers to verify the information being transmitted in headers or cookies.
Tip
Check the 'exp' claim to verify that your token hasn't already expired during debugging.
Q: Is it safe to paste my JWT here? A: Yes, the decoding logic runs entirely in your browser using JavaScript. Your token data is never sent to our servers.
Q: Why can't I see the signature secret? A: JWTs are encoded, not encrypted. You can see the content without a secret, but the secret is only required to verify or sign the token.
Q: What does the 'exp' claim mean? A: The 'exp' (expiration) claim identifies the timestamp after which the JWT must not be accepted for processing.
Q: Can this tool modify a JWT? A: This is a decoder-only tool designed for inspection. Modifying a token would invalidate the signature, requiring it to be resigned with the original secret.
Tip
Use the 'sub' (subject) claim to identify the unique principal that the JWT is issued for.