JWT Decoder

Free Online JWT Decoder -- Five JSON Web Token Tools in One

This page provides five browser-based JWT utilities accessible from the left sidebar. Every tool runs entirely in your browser -- no data is uploaded to any server, nothing is logged, and no account is required. Paste your token or upload a file, select a tool from the sidebar, and the result appears immediately.

Online JWT Decoder -- Read Header and Payload Without a Library

JSON Web Tokens are three Base64URL-encoded segments joined by dots. The first segment is the header, the second is the payload, and the third is the signature. The JWT Decoder splits the token at the dots, decodes the first two segments from Base64URL, and presents them as formatted JSON so you can read every claim without installing any library or running any command.

What the JWT Decoder Shows

The header is displayed in pink, the payload in blue, and the signature in purple. Each section has an individual Copy button so you can extract just the part you need. If the token cannot be decoded -- because it has the wrong number of segments or a segment is not valid Base64URL JSON -- the decoder shows a clear error message explaining what went wrong.

File Upload for JWT Decoding

You can upload a file containing your JWT token by clicking the Upload button or by dragging a .txt, .jwt, or .json file directly onto the input area. The file contents are loaded into the editor and decoded immediately. This is useful when tokens are saved to disk during debugging or when working with tokens exported from authentication logs.

Signature Decoding and Verification

The decoder displays the signature segment in its raw Base64URL form. Unlike the header and payload, the signature is not a JSON structure -- it is a cryptographic hash computed from the header, payload, and a secret key. Decoding it back to plaintext is not possible because it is the output of a one-way hash function. Verifying whether the signature is correct requires the original secret key (for HMAC algorithms) or the public key (for RSA and ECDSA algorithms), and this must be done server-side.

JWT Validator -- Check Token Structure and Expiry Claims Online

The JWT Validator runs a structured checklist against your token and displays a pass, warning, or fail status for each item. It checks for the correct three-part dot-separated structure, verifies that the header and payload decode as valid JSON, inspects the algorithm and type claims in the header, and evaluates the time-based payload claims against your browser's current time.

Expiry and Time Claims Explained

The validator checks four time-based claims. The exp (expiry) claim is compared against the current UTC timestamp -- if the current time is past the exp value, the token is expired and the check fails with the exact expiry date shown. The nbf (not before) claim is the opposite -- if the current time is before the nbf value, the token is not yet valid. The iat (issued at) claim is shown for reference as the time the token was minted. The sub (subject) claim identifies the principal the token represents, and its absence triggers a warning.

What the JWT Validator Cannot Check

Because the validator runs in the browser without a secret key or public key, it cannot verify whether the signature is authentic. A token could have a completely forged signature and still pass all the structural and claim checks shown here. Always perform signature verification on your server using a trusted JWT library before trusting any token in your application.

Free JWT Encoder -- Understand Token Structure Without a Backend

The JWT Encoder takes a JSON header and JSON payload, Base64URL-encodes each part, and assembles them into the standard header.payload.signature format. It is useful for understanding how tokens are structured, testing JWT parsers with known inputs, and building examples for documentation. The signature segment is a placeholder because browser JavaScript cannot access cryptographic secrets safely.

Standard JWT Claims to Include in the Payload

The IETF JWT specification defines a set of registered claim names that most libraries and services recognise. The most important are sub (the subject the token is about, usually a user ID), iat (the Unix timestamp when the token was issued), exp (the Unix timestamp after which the token must not be accepted), iss (the issuer -- your application or auth server), aud (the intended audience -- the service that should accept the token), and jti (a unique token identifier useful for revocation lists). All are optional but using them consistently makes your tokens interoperable with standard libraries and middleware.

JWT Header Inspector -- Understand Algorithms and Key Types

The Header Inspector extracts every claim from the JWT header and displays each one in a labelled card. Below the claims it shows a plain-language note about the algorithm family. This is useful when auditing tokens from third-party identity providers, debugging authentication middleware, or checking that a token uses the expected algorithm before accepting it.

JWT Algorithm Families

JWT supports three main algorithm families. HMAC algorithms -- HS256, HS384, HS512 -- use a shared secret. The same secret is used to sign the token and to verify it, which means both parties must keep the secret confidential. RSA algorithms -- RS256, RS384, RS512 -- are asymmetric. A private key signs the token and a public key verifies it. The public key can be distributed freely without compromising security. ECDSA algorithms -- ES256, ES384, ES512 -- are also asymmetric but produce smaller signatures than RSA. The none algorithm produces no signature at all and must never be accepted by a production server.

Base64URL Decode -- Inspect JWT Segments and Encoded Strings Online

Base64URL is a variant of standard Base64 where the + character is replaced with - and the / character is replaced with _, making the encoded string safe for use in URLs, HTTP headers, and query parameters without percent-encoding. The trailing = padding characters are also typically omitted. The Base64URL Decode tool handles all of these variations automatically and re-adds padding before decoding.

When to Use Base64URL Decode

Use this tool to inspect an individual JWT header or payload segment without pasting the full token. Copy just the first part (before the first dot) or the second part (between the two dots) and paste it into the decoder to see the JSON. It is also useful for decoding Base64URL-encoded values in OAuth 2.0 authorization codes, PKCE code challenges, and other places where the encoding is used outside of a full JWT context.

Related Developer and Security Tools

If you work with authentication, APIs, and structured data regularly, these tools on the site complement the JWT tools on this page:

• JSON Formatter -- format, validate, minify, and convert JSON to CSV or XML
• SQL Formatter -- beautify, minify, and validate SQL queries
• Code Formatter -- format HTML, CSS, JSON, XML, and JavaScript in one tool
• AI Table Generator -- generate formatted HTML tables from a plain-text description using AI