JWT Decoder

How to decode a JWT

Paste the token and decode

Paste the encoded token into the Encoded JWT field and click Decode token. Whitespace and line breaks are removed automatically, so a token copied from a log file or a wrapped email line still decodes. Clicking Decode token with an empty field shows "Paste a JWT before decoding."

Read the header and payload

The header and payload appear as JSON, pretty-printed with two-space indentation — the same layout the JSON Formatter produces. The header typically names the signing algorithm (alg) and token type (typ); the payload carries the claims, such as a subject or a name. The token's third part, the signature, is shown exactly as pasted and is never checked.

Copy and clear

Copy header and Copy payload each write one decoded value to your clipboard; clicking either before decoding shows "Decode a token first before copying." Clear text empties the field and the results and returns focus to the Encoded JWT field.

What is inside a JWT

Three Base64URL parts

A JSON Web Token is three Base64URL strings separated by dots: header.payload.signature. Base64URL is a Base64 variant that uses - and _ instead of + and /, with no = padding, so tokens travel safely in URLs and headers. This tool accepts strict Base64URL only: a segment containing +, /, or = is rejected with an error instead of being silently reinterpreted. Pasting fewer or more than three parts — a truncated token, or a five-part encrypted JWE token — shows the three-part error message.

Registered time claims

When the payload contains numeric iat (issued at), nbf (not before), or exp (expiration time) claims, a small table shows each raw value next to its conversion to a UTC time. These conversions are read directly from the token for readability only. The tool does not evaluate them — an expired token decodes exactly like a live one, and nothing in the result says whether a token is currently usable.

Decoding is not verifying

Anyone can decode a JWT

Base64URL is an encoding, not encryption. Anyone who holds a JWT can read its header and payload with a few lines of code — no key or password is involved in decoding. That is why secrets never belong in a JWT payload, and why being able to decode a token proves nothing about who issued it.

What this tool never does

This tool does not verify the signature, so it cannot tell you whether a token is authentic, whether its contents were tampered with, or whether it was issued by a party you trust. It also does not evaluate expiry or any other claim. To verify a token, use a JWT library on the system that holds the signing key and check the signature and claims there.

Worked example

Decoding this token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.c2lnbmF0dXJlLW5vdC1jaGVja2Vk

Decoded header:

{
  "alg": "HS256",
  "typ": "JWT"
}

Decoded payload:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

The time claims table shows iat 1516239022 converted to 2018-01-18T01:30:22.000Z.

The third segment of this example token is placeholder text rather than a real cryptographic signature — and the tool decodes it anyway, because it never checks signatures. Keep that gap between decoding and verifying in mind whenever you inspect a token.

Private, browser-based token decoding

The token you paste and everything decoded from it stay in this browser. Nothing is uploaded or sent to a 247 Tools server, and the tool does not save token history — which matters because a live JWT is a credential: anyone who obtains it can use it until it expires. Be deliberate about where production tokens travel. Copy header and Copy payload write only the value you choose to your system clipboard, and Clear text removes the token and results from the page; neither clears your system clipboard.

Related tools