Decode and inspect JSON Web Tokens to view headers, claims, expiration timestamps, and other token payload information directly in your browser.
Paste a JWT and decode its header, payload, and signature.
Your support helps us build more tools and improve the ones you already use.
More tools you may find useful.
Encode text to Base64 or decode Base64 strings back to readable text directly in your browser.
Convert JSON to YAML or YAML to JSON with validation and formatted output directly in your browser.
Test JavaScript regular expressions against text, inspect matches, and experiment with regex flags directly in your browser.
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text directly in your browser.
JWT Decoder is a browser-based tool for inspecting JSON Web Tokens. It decodes the Base64URL-encoded header and payload, displays the signature, identifies common claims, and converts JWT timestamps into readable dates. Decoding is performed locally in your browser and does not verify the token signature.
JSON Web Token (JWT) is a compact token format commonly used to transmit claims between applications and services. JWTs are frequently used in authentication and authorization systems, particularly for APIs and distributed applications.
A typical JWT contains three dot-separated components: a header, a payload, and a signature. The header describes the token type and signing algorithm, the payload contains claims, and the signature is used by a verifier to establish that the signed token has not been altered.
The decoder separates a JWT into its header, payload, and signature components and makes the readable portions easier to inspect.
It also identifies commonly used claims such as subject, issuer, audience, issued-at time, not-before time, and expiration time. Numeric JWT timestamps are converted into readable dates and relative time information.
JWT decoding and JWT verification are different operations. A JWT can be decoded without possessing the secret or private key used to sign it.
The header and payload should therefore be considered untrusted data until the token has been properly verified. Seeing a valid-looking claim or expiration date does not prove that the token was issued by a trusted party.
Never place passwords, private keys, client secrets, or other confidential information into JWT claims unless you fully understand the security implications. JWT payloads are encoded, not encrypted.
The header and payload of a JWT are Base64URL-encoded JSON objects. Base64URL encoding makes the data suitable for transmission in URLs and HTTP contexts, but it does not provide confidentiality.
Anyone who has access to a JWT can generally decode its header and payload. The signature provides integrity and authentication when it is verified with the appropriate cryptographic key.
ToolTunnel's JWT Decoder performs decoding in your browser. The token does not need to be uploaded to a ToolTunnel backend for the decoding operation.
Even though processing is local, you should still avoid pasting sensitive production credentials or tokens into tools unless you understand the environment and your organization's security requirements.
This tool decodes JWT structure but does not cryptographically verify signatures. It also does not determine whether a token was legitimately issued by an identity provider.
JWT implementations can use different claim sets and application-specific fields. A missing standard claim is not necessarily an error because applications may define their own token structure.
Yes. The header and payload of a JWT can normally be decoded without the signing secret or private key because they are encoded rather than encrypted.
No. Decoding only makes the token contents readable. Signature verification requires the appropriate cryptographic key and verification algorithm.
A standard signed JWT is not encrypted. Its header and payload are Base64URL-encoded and can be decoded by anyone who has the token. Encrypted JWTs use a different mechanism such as JWE.
The exp claim specifies the expiration time of a JWT as a NumericDate, normally represented as seconds since the Unix epoch.
The iss claim identifies the issuer of the JWT. Applications can use it during verification to determine whether a token came from an expected authority.
The aud claim identifies the intended audience of the token. It can be a string or an array of strings depending on how the JWT was created.
The decoder processes the token locally in your browser, but you should still avoid sharing sensitive production credentials or tokens unnecessarily. Follow your organization's security policies when handling authentication tokens.
It can inspect the structure and claims of a JWT, but it does not cryptographically verify the signature. Proper validation must be performed by the application using the appropriate signing key and expected token parameters.