JWT Decode Online

What is a JWT?

A JWT (JSON Web Token, RFC 7519) is a compact token format that carries JSON claims, commonly used for API authentication and authorization. A token has three parts—Header (algorithm and type), Payload (claims such as user ID and exp expiration), and Signature (integrity check)—each Base64URL-encoded and joined with dots (compact serialization in RFC 7515 (JWS)).

Tool Overview

Use this JWT decoder for JWT decode online: paste a token to inspect the header and payload locally in your browser. It also supports HS-family signature verification with a secret when debugging APIs or authentication. See MDN: Base64 for encoding background.

Need to generate a test token? Use the JWT Encoder.

FAQ (essentials)

What are the three parts of a JWT?

The Header describes the algorithm and type; the Payload holds claims (e.g. user ID, expiration); the Signature is computed from the first two parts and a secret to ensure the token has not been tampered with. All three are Base64URL-encoded and joined with dots (see RFC 7515).

Is the decoded content sent to a server?

Decoding and display happen entirely in your browser; the token and secret are not sent to any server, so you can safely inspect tokens that contain sensitive data.

Why does signature verification fail?

Ensure the secret matches the one used to sign the token. For RS/ES and other asymmetric algorithms, this tool only decodes; verification with a public key must be done on the server.

How to Use

Enter a JWT

Paste a full JWT string (e.g. eyJhbGc...xxx.yyy.zzz) into the input at the top, or click an example to load a sample token. The page will decode and display the Header and Payload automatically.

View Decoded Result

The result is shown in a structured view: Header shows algorithm (alg) and type (typ); Payload shows standard claims (e.g. exp, iat, sub) and custom fields. If the token is expired, remaining time or expiration status is indicated.

Verify Signature (Optional)

To verify an HMAC signature, enter the signing secret in the "Secret" field and click "Verify". Only HS256/HS384/HS512 are supported for local verification; asymmetric algorithms (RS/ES) must be verified on the server.

FAQ

Q: What is a JWT?

A JWT (JSON Web Token) is an open standard defined in RFC 7519 for securely transmitting JSON claims between parties. Compact serialization (JWS) is in RFC 7515. The typical form is Header.Payload.Signature with Base64URL-encoded segments.

Q: How do I decode JWT online?

Paste the full JWT string into the input box. The tool decodes the header and payload per RFC 7519 in your browser. For HS algorithms, enter your secret to verify the signature locally—nothing is uploaded.

Q: Is the decoded content sent to a server?

Decoding and display happen entirely in your browser; the token and secret are not sent to any server, so you can safely inspect tokens that contain sensitive data.

Q: What are the three parts of a JWT?

The Header describes the algorithm and type; the Payload holds claims (e.g. user ID, expiration); the Signature is computed from the first two parts and a secret to ensure the token has not been tampered with. All three are Base64URL-encoded and joined with dots (see RFC 7515).

Q: Why does signature verification fail?

Ensure the secret matches the one used to sign the token. For RS/ES and other asymmetric algorithms, this tool only decodes; verification with a public key must be done on the server.