Developer
Encoders, converters & dev utilities
Decode a JWT — Read the Header & Payload In-Browser
A JSON Web Token (JWT) is three base64url-encoded parts joined by dots: base64url(header).base64url(payload).base64url(signature) (RFC 7519 over the JWS Compact Serialization, RFC 7515). Decoding a JWT simply base64url-decodes the first two parts and JSON.parses them — it reveals the algorithm in the header (e.g. {"alg":"HS256","typ":"JWT"}) and every claim in the payload (sub, name, iat, exp, and any custom scopes or roles). The critical thing to understand: decoding is NOT verification. The payload is plaintext-readable by anyone who has the token, so never treat a decoded token as trusted — only signature verification with the correct key establishes authenticity. This decoder runs 100% in your browser, so your production token never leaves the page (check the network tab). Free, no login.
Structure: header . payload . signature — three base64url parts joined by dots (RFC 7519 / JWS RFC 7515)
- Decode = base64url-decode + JSON.parse of the header and payload — no key needed to read them
- Header carries the algorithm: {"alg":"HS256","typ":"JWT"} (auto-detected from the token)
- Worked example — payload {"sub":"1234567890","name":"Jane","iat":1516239022,"exp":1516242622}
- iat 1516239022 = 2018-01-18 01:30:22 UTC; exp 1516242622 = one hour later (NumericDate = epoch seconds)
- base64url ≠ base64: uses - and _ (not + and /) and omits = padding — decode handles both
- Decode ≠ trust: the payload is readable by anyone; only signature verification proves authenticity
Frequently asked questions
How do I decode a JWT?
A JWT is three dot-separated parts: base64url(header).base64url(payload).base64url(signature). To decode it you base64url-decode the first part to get the header (e.g. {"alg":"HS256","typ":"JWT"}) and the second part to get the payload (the claims, e.g. {"sub":"1234567890","name":"Jane","iat":1516239022,"exp":1516242622}), then JSON.parse each. No key or secret is required to decode — the header and payload are only base64url-encoded, not encrypted. Paste your token and it is decoded instantly, entirely in your browser.
Is decoding a JWT the same as verifying it?
No — and this is the single most important thing to understand. Decoding only base64url-decodes the header and payload; it does not check the signature. Because the payload is plaintext-readable by anyone holding the token, a decoded token proves nothing about who issued it. Only signature verification — recomputing the signature over header.payload with the correct key (the shared secret for HS256, or the public key/JWKS for RS256/ES256) — establishes that the token is authentic and untampered. Never trust a token just because you could read its claims.
Does my token get sent to a server when I decode it?
No. This decoder is 100% client-side: the base64url decode and JSON.parse happen in your browser using JavaScript, and the token is never transmitted anywhere. You can confirm this by opening your browser network tab while you paste and decode — there is no request carrying the token. That privacy guarantee is why this tool is safe to use with production or session tokens, unlike server-side decoders where you are pasting a live credential into someone else's backend.