JWT decoder
Decode a JWT header and payload in the browser. The signature is shown but not verified unless you paste an HMAC secret (HS256 only). Do not paste production secrets on a shared machine.
Header
Payload
Signature (Base64url)
About JWT decoder
Decode a JSON Web Token online and inspect its header and payload claims, including issuer, subject, audience, expiry, issued-at, and scopes. This free JWT decoder helps you debug authentication and authorization problems, confirm which user a token represents, and check whether a token has expired. The token is only decoded, never verified against a secret or private key, and nothing is transmitted.
Frontend and backend developers paste an access token from localStorage, a cookie, or a gateway log and read the claims without adding a breakpoint. You can see the algorithm in the header, custom claims in the payload, and timestamps that explain a sudden 401. Product and security people use it to understand what an app is putting in a JWT during a review.
This tool does not validate signatures. A decoded token can still be forged; use your auth server or a proper verifier when you need trust. Decoding is still the right first step when the question is what is inside this string. Header and payload are shown as readable JSON you can copy into the JSON viewer if you need a tree.
Because everything runs in your browser, access tokens stay on your own device. Do not paste tokens into random websites that upload them. Use this free online JWT decoder whenever you need a private look at JWT header and payload claims.