JWT Decoder — Decode Any JWT Token Instantly

Paste your JWT token above and decode it in one click. The header, payload, and signature are rendered as readable JSON — no server calls, no login, no data ever leaves your browser.

✓ 100% Client-Side ✓ All Algorithms Supported ✓ Expiry Detection ✓ Bearer Token Ready ✓ Free Forever
JWT Decoder
Paste a JWT token and click Decode
Decoded Output
Awaiting valid token...
HEADER
— waiting —
PAYLOAD
— waiting —
SIGNATURE
— waiting —
Saeed Ahmed Saeed Ahmed jan 10, 2026

What Is a JWT Token? An Explanation

A JSON Web Token (JWT, pronounced "jot") is a compact, self-contained string that securely carries information between two parties. You see them constantly in modern web development — they are the tokens returned when you log in, the bearer tokens attached to every API request, and the access tokens your OAuth provider hands you after authorization.

A JWT is made of three Base64url-encoded sections joined by dots. There is no encryption by default — the data is encoded, not hidden. That is why a JWT decoder can read the contents instantly, without any secret key.

The Three Parts of a JWT

1. Header — Describes the token type and the signing algorithm used. After decoding, it looks like {"alg":"HS256","typ":"JWT"}. The algorithm could be symmetric (HS256, HS512) or asymmetric (RS256, ES256, PS256).

2. Payload — The meat of the token. Contains claims: key-value pairs that assert facts about the user or session. Standard claims include sub (user ID), exp (expiry timestamp), iat (issued-at), iss (issuer), and aud (audience). Your app can add any custom claims it needs.

3. Signature — A cryptographic hash of the header and payload, created with a secret key or private key. It guarantees the token has not been tampered with. You cannot verify the signature client-side without the key — but you can always read the header and payload.

Quick Fact Every JWT starts with eyJ — that is Base64url for the opening {" of the JSON header object. If your token starts with anything else, it is likely not a standard JWT.

How to Decode a JWT Token Online — Step by Step

  • 1
    Get your JWT token Find it in your API response, browser DevTools (Application → Local Storage or Cookies), Authorization header, or your auth provider's dashboard. It is three Base64url strings separated by dots.
  • 2
    Paste it into the input panel Copy the entire token — including all three parts and both dots — and paste it into the input area at the top of this page. If it is a bearer token, paste everything after Bearer .
  • 3
    Click Decode Press the Decode button (or hit Ctrl+Enter). The JWT parser immediately splits the token and displays the header and payload as colour-coded JSON.
  • 4
    Read your claims Inspect the decoded output. Unix timestamps like exp and iat are automatically converted to human-readable dates. Check the algorithm, user ID, roles, permissions, and any custom claims your application sets.

Standard JWT Claims Explained

When you decode a JWT token, the payload contains claims. Here are the registered claims defined by RFC 7519 that you will encounter most often:

Claim Full Name Description Example Value
sub Subject Unique identifier for the user or entity the token represents "1234567890"
iss Issuer Who created and signed the token (e.g. your auth server domain) "https://auth.example.com"
aud Audience Intended recipient — the API or service that should accept the token "api.example.com"
exp Expiration Time Unix timestamp after which the token must not be accepted 1893456000
iat Issued At Unix timestamp when the token was created 1516239022
nbf Not Before Token must not be accepted before this timestamp 1516239022
jti JWT ID Unique identifier for the token, used to prevent replay attacks "abc123-xyz"

Supported JWT Algorithms

This JWT decoder works with tokens signed by any algorithm. Here is a quick reference for what you will see in the alg field of the decoded header:

Algorithm Type Key Type Common Use Case
HS256 HMAC + SHA-256 Shared secret Single-server apps, microservices with shared secret
HS384 / HS512 HMAC + SHA-384/512 Shared secret Higher-security symmetric signing
RS256 RSA + SHA-256 RSA key pair Auth0, AWS Cognito, enterprise SSO
RS384 / RS512 RSA + SHA-384/512 RSA key pair High-assurance enterprise systems
ES256 ECDSA + SHA-256 EC key pair Mobile apps, IoT — smaller token size
PS256 RSASSA-PSS + SHA-256 RSA key pair FAPI, open banking compliance
none Unsigned None Testing only — never in production

Is It Safe to Decode a JWT Online?

Security-conscious developers rightly ask this question before pasting anything into a third-party tool. Here is an honest answer.

This tool is 100% client-side. The JavaScript that decodes your token runs entirely inside your browser. No token data is transmitted to any server, stored in a database, or logged anywhere. You can verify this by opening your browser's Network tab — you will see zero outbound requests when you click Decode.

That said, a few good practices apply regardless of which tool you use:

Use test tokens for inspection. If you are debugging in a shared environment (pair programming, screen share, public computer), use a test token rather than a production access token containing real user data.

Remember payloads are not secret. JWT payloads are only Base64url-encoded. Anyone who has the token string can read the claims. If your payload contains information you need to keep confidential, you need JWE (JSON Web Encryption), not a standard signed JWT.

Rotate compromised tokens immediately. If you accidentally expose a production JWT — in a log file, a GitHub commit, or a public paste — revoke it immediately from your auth provider and issue new tokens to affected users.

Best Practice Never paste long-lived tokens (refresh tokens, API keys, personal access tokens) into any online tool. Decode only short-lived access tokens, and prefer using test credentials during development.

Frequently Asked Questions

What is the difference between a JWT decoder and jwt.io? ›
jwt.io is the official reference tool from Auth0. Our JWT decoder does the same core job — decode the header, payload, and signature — but with a VS-Code-style dark interface, instant expiry parsing, and an entirely client-side implementation. Both are reliable choices for inspecting tokens during development.
Can I decode a refresh token? ›
It depends on the auth provider. Some providers issue refresh tokens as opaque random strings (not JWTs), which cannot be decoded because they have no internal structure. Others, like Keycloak or certain Firebase configurations, issue refresh tokens as JWTs. If yours starts with eyJ, paste it in and it will decode. If it is a random string, it is opaque and not decodable by design.
How do I decode a JWT in Flutter or Dart? ›
Use the dart_jsonwebtoken package from pub.dev. Call JWT.decode(token) to read the payload without signature verification. For full verification with a secret or public key, use JWT.verify(token, key). Alternatively, manually split by '.' and base64-decode the second segment using base64Url.decode() from Dart's convert library.
What does "decode JWT token online" actually do? ›
It splits the token by the dot separator, takes the first two parts (header and payload), applies Base64url decoding to each one, and then JSON.parses the resulting byte strings into readable objects. The third part (signature) is displayed as-is because it is a cryptographic hash, not JSON. The whole process takes under a millisecond and runs entirely in your browser.
Why does my token fail to decode? ›
The most common reasons are: (1) the token is an opaque token, not a JWT — it will not have the three-part dot structure; (2) you copied only part of the token — make sure you include all three segments; (3) there are trailing spaces or newline characters — the decoder trims input automatically but some environments wrap tokens in quotes; (4) it is a JWE encrypted token — the payload will be ciphertext, not JSON. Check the raw token starts with eyJ.
How do I decode a JWT access token from OAuth2 / OpenID Connect? ›
OAuth2 access tokens from providers like Google, Microsoft, Okta, and Auth0 are standard JWTs. Copy the access_token value from the token response and paste it here. The decoded payload will typically include iss (issuer URL), sub (user ID), aud (client ID), exp, and provider-specific claims like email, roles, or scopes.