This breaks a JSON Web Token into its two readable parts, the header and the payload, and shows each as formatted JSON. JWTs are widely used for authentication in web apps, and being able to quickly see what's actually inside one is useful for debugging a login or API issue.
How to use it
- Paste the full JWT string, including all three dot separated parts.
- The header decodes automatically as formatted JSON.
- The payload decodes the same way just below it.
- Review the claims, like an expiration time or a user ID.
- Paste a different token anytime to decode a new one.
When it helps
- Debugging why an API request is being rejected by checking the claims in a token.
- Verifying a token's expiration is set correctly during development.
- Inspecting what user information or permissions a token actually grants.
- Understanding a JWT's structure while learning how token based authentication works.
- Checking a third party service's token format when integrating a new provider.
Good to know
- Decoding a JWT doesn't verify its signature. This only reads the readable header and payload, it doesn't confirm the token is genuine.
- Don't paste a real, sensitive production token into a third party tool if you're worried about exposure. Treat tokens like passwords.
- A JWT's payload is only Base64 encoded, not encrypted, so anyone with the token can already read its contents without decoding it here.
- Check a token's exp claim first when debugging an authentication issue, since an expired token is one of the most common causes of unexpected login failures.
- When comparing tokens from two different environments, like staging and production, decode both and compare their claims side by side to catch a configuration difference quickly.
Questions
Does decoding a JWT confirm it hasn't been tampered with?
No, decoding only reads the header and payload, which are simply Base64 encoded. Verifying authenticity requires checking the signature against the issuing server's key, which this tool doesn't do.
Why does a JWT have three parts separated by dots?
The header describes the token's type and signing algorithm, the payload holds the actual claims, and the signature verifies the token hasn't been altered.
Is it safe to decode a production token here?
Since decoding happens entirely in your browser and nothing is sent elsewhere, it's technically safe, but as a general habit it's wise to treat any real token carefully and avoid unnecessary exposure.
What do common fields like iat and sub mean?
iat typically stands for issued at, recording when the token was created, while sub stands for subject, usually identifying the user the token represents. Exact fields vary by the issuing system.
Can I edit a decoded JWT and use the modified version?
This only decodes and displays a token's contents. Editing the payload would invalidate its signature, so a legitimately modified token needs to be properly re-signed by the issuing server.
Can two different JWTs have the same payload?
Yes, if they were issued with identical claims and at the same time, though in practice most tokens include something like a unique ID or timestamp that makes them distinct.