Decode JSON Web Tokens (JWT) safely and instantly right in your browser. All decoding runs entirely client-side, ensuring your tokens and sensitive payload claims are never sent over the network.
Paste a token above to inspect the signature.
Key Features of JWT Decoder
- Three-Way Split Views Separates the token into its individual header, payload, and signature blocks automatically.
- Local Base64 Decoding Decodes claims synchronously using Javascript memory, preventing trace logs on remote servers.
- Claim Humanizations Converts Unix epoch numbers like 'exp' or 'iat' into readable localized date and time stamps.
- Syntax Highlighted Previews Formats raw decoded JSON blocks with color-coded key-value highlighting for fast reading.
JWT Decoder Examples
Decoding Authentication Token
Deconstruct an OAuth payload to retrieve the authenticated user email and scopes.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cOutput
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "1234567890", "name": "John Doe", "iat": "2018-01-18 11:17:02" }How to Use JWT Decoder
-
1. Paste a JWT Token
Copy a JWT token from your app, API client, or browser dev tools and paste it into the input field.
-
2. View the Decoded Parts
The tool splits the token into its header, payload, and signature sections and decodes the base64 data.
-
3. Review the Claims
Inspect the algorithm, issued-at time, expiry, and any custom claims in the decoded payload.
Common Use Cases for JWT Decoder
- API Payload Debugging Inspect OAuth header payloads or custom claim states during endpoint connections.
- Investigating Expiry Errors Decode tokens to verify if expirations are correctly aligned with local system servers.
- Session Claim Auditing Check user scopes, role permissions, or email claims to debug frontend views.
The Technical Details
The JWT Decoder operates completely on your local device. When you paste a token, the JavaScript router splits the string by its period (.) delimiters, capturing the first two base64url segments.
The tool decodes these blocks into plain JSON text using standard Base64-to-UTF8 conversions (wrapping the browser’s atob API to correctly handle special URL-safe dash and underscore characters). Once parsed, UNIX epoch integer tags are fed through the JavaScript Date class constructor to translate times.
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three base64-encoded parts: header, payload, and signature.
Is it safe to paste my token here?
The tool only decodes, and does not verify the signature. Never paste production tokens that grant privileged access into any online tool.
Is my token sent to a server?
No. Decoding runs in your browser; nothing is transmitted anywhere.
Where is the algorithm listed?
The signing algorithm (e.g. HS256, RS256) is in the decoded header under the 'alg' key.