Decode a JWT online

How it works

1. 1

   Paste the token into the JWT box.

2. 2

   Read the decoded header and payload.

3. 3

   Check claims such as exp and aud.

4. 4

   Copy the JSON you need from either panel.

About the JWT Decoder

A JSON Web Token carries its claims in Base64URL-encoded JSON, so you cannot read who it belongs to or when it expires just by looking at it. This decoder splits a token into its three parts, decodes the header and payload, and shows them as formatted JSON. It is useful for debugging sign-in flows and API authorisation without writing a script.

What you can do

• Paste a token and see its header, including the alg and typ fields.
• Read the payload claims, such as sub, iss, aud, iat and exp, as indented JSON.
• View the signature segment as raw text.
• Create a Share link that reopens the tool with the same token.

When it works best

• Checking which user ID, roles or scopes an access token from your identity provider contains.
• Finding out why an API returns 401 by reading the exp or aud claim.
• Comparing the tokens issued by staging and production configurations.

Things to know

• Decoding runs in your browser. Share links embed the token in the URL, so never share a link for a live token.
• The signature is shown but not verified, so a decoded token is not proof that it is genuine.
• Timestamps such as exp and iat stay as Unix seconds; convert them with the Unix Timestamp Converter.
• Encrypted JWE tokens with five parts are not supported. To create a test token, use the JWT Encoder.

Frequently asked questions