JWT Decoder — Decode Any JWT Token Instantly

What Is a JWT Token? A Plain-English Explanation

A JSON Web Token (JWT, pronounced "jot") is a compact, self-contained string that securely carries information between two parties. You see them constantly in modern web development — they are the tokens returned when you log in, the bearer tokens attached to every API request, and the access tokens your OAuth provider hands you after authorization.

A JWT is made of three Base64url-encoded sections joined by dots. There is no encryption by default — the data is encoded, not hidden. That is why a JWT decoder can read the contents instantly, without any secret key.

The Three Parts of a JWT

1. Header — Describes the token type and the signing algorithm used. After decoding, it looks like {"alg":"HS256","typ":"JWT"}. The algorithm could be symmetric (HS256, HS512) or asymmetric (RS256, ES256, PS256).

2. Payload — The meat of the token. Contains claims: key-value pairs that assert facts about the user or session. Standard claims include sub (user ID), exp (expiry timestamp), iat (issued-at), iss (issuer), and aud (audience). Your app can add any custom claims it needs.

3. Signature — A cryptographic hash of the header and payload, created with a secret key or private key. It guarantees the token has not been tampered with. You cannot verify the signature client-side without the key — but you can always read the header and payload.

How to Decode a JWT Token Online — Step by Step

1. 1
   Get your JWT token Find it in your API response, browser DevTools (Application → Local Storage or Cookies), Authorization header, or your auth provider's dashboard. It is three Base64url strings separated by dots.
2. 2
   Paste it into the input panel Copy the entire token — including all three parts and both dots — and paste it into the input area at the top of this page. If it is a bearer token, paste everything after Bearer .
3. 3
   Click Decode Press the Decode button (or hit Ctrl+Enter). The JWT parser immediately splits the token and displays the header and payload as colour-coded JSON.
4. 4
   Read your claims Inspect the decoded output. Unix timestamps like exp and iat are automatically converted to human-readable dates. Check the algorithm, user ID, roles, permissions, and any custom claims your application sets.

Standard JWT Claims Explained

When you decode a JWT token, the payload contains claims. Here are the registered claims defined by RFC 7519 that you will encounter most often:

JWT Decode vs JWT Decrypt — What Is the Difference?

This is the question developers ask most often, and the confusion is completely understandable. The words decode and decrypt sound interchangeable, but they describe fundamentally different operations when it comes to JWT tokens.

Decoding reverses Base64url encoding. Because standard JWTs are only encoded — not encrypted — anyone who holds the token string can decode and read the payload. The signing signature on a JWT proves the token has not been tampered with, but it does not hide the payload from view.

Decryption applies to JWE (JSON Web Encryption) tokens. In a JWE, the payload is genuinely encrypted using a key, and it cannot be read without that key. JWEs are much less common than standard signed JWTs and require a different tool and the corresponding decryption key.

How to Decode a JWT in Code — Language Examples

Our online JWT parser is the quickest way to inspect a token, but sometimes you need to decode a JWT programmatically inside your application. Here are concise examples for the most popular languages.

function decodeJWT(token) {
  const [,payload] = token.split('.');
  const b64 = payload
    .replace(/-/g, '+')
    .replace(/_/g, '/');
  return JSON.parse(atob(b64));
}

// npm install jwt-decode
import { jwtDecode } from 'jwt-decode';
 
const decoded = jwtDecode(token);
console.log(decoded.sub);
console.log(decoded.exp);

# pip install PyJWT
import jwt
 
decoded = jwt.decode(
  token,
  options={
    "verify_signature": False
  }
)
print(decoded["sub"])

// composer require firebase/php-jwt
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
 
$decoded = JWT::decode(
  $token,
  new Key($secret, 'HS256')
);

import { jwtDecode } from 'jwt-decode';
import { useMemo } from 'react';
 
function useJWT(token) {
  return useMemo(() =>
    token ? jwtDecode(token) : null,
    [token]
  );
}

import base64, json
 
def decode_jwt(token):
  part = token.split(".")[1]
  pad = part + "=" * (-len(part) % 4)
  return json.loads(
    base64.urlsafe_b64decode(pad)
  )

Supported JWT Algorithms

This JWT decoder works with tokens signed by any algorithm. Here is a quick reference for what you will see in the alg field of the decoded header:

Is It Safe to Decode a JWT Online?

Security-conscious developers rightly ask this question before pasting anything into a third-party tool. Here is an honest answer.

This tool is 100% client-side. The JavaScript that decodes your token runs entirely inside your browser. No token data is transmitted to any server, stored in a database, or logged anywhere. You can verify this by opening your browser's Network tab — you will see zero outbound requests when you click Decode.

That said, a few good practices apply regardless of which tool you use:

Use test tokens for inspection. If you are debugging in a shared environment (pair programming, screen share, public computer), use a test token rather than a production access token containing real user data.

Remember payloads are not secret. JWT payloads are only Base64url-encoded. Anyone who has the token string can read the claims. If your payload contains information you need to keep confidential, you need JWE (JSON Web Encryption), not a standard signed JWT.

Rotate compromised tokens immediately. If you accidentally expose a production JWT — in a log file, a GitHub commit, or a public paste — revoke it immediately from your auth provider and issue new tokens to affected users.