JWT Decoder
Fast, accurate, and free online JWT Decoder tool that runs directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "Jane Doe",
"admin": true,
"iat": 1516239022
}
Full Text Report
JWT Decoder Report
==================
Parts
-----
Header (b64url): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Payload (b64url): eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0
Signature (b64url): SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Algorithm
---------
alg: HS256
Claims (highlights)
-------------------
sub: 1234567890
iat: 1516239022 (2018-01-18T01:30:22+00:00Z)
Decoded Header
--------------
{
"alg": "HS256",
"typ": "JWT"
}
Decoded Payload
---------------
{
"sub": "1234567890",
"name": "Jane Doe",
"admin": true,
"iat": 1516239022
}
Rate this tool:
Related tools
Other tools you may find usefulJWT Token Decoder
The JWT (JSON Web Token) decoder allows you to instantly decode each JWT token and read its header and payload in readable JSON form. The tool supports HMAC (HS256, HS384, HS512) and RSA (RS256, RS384, RS512) signature verification - no library installation, no backend.
What is JWT?
JSON Web Token (JWT) is an open standard (RFC 7519) for the secure exchange of information in the form of signed JSON. The token consists of three segments separated by dots:header(header with metadata and algorithm),payload(payload with so-called claims, e.g.sub, exp, iat) andsignature(digital signature). Each segment is encoded in base64url format. JWT is widely used in authentication (OAuth 2.0, OIDC) and data exchange between microservices.
How to use the decoder?
Paste the JWT token into the text field - the tool will automatically split it into three segments and decode the header and payload into readable JSON. To verify an HMAC signature, select the "Verify Signature" mode, set the algorithm (or leave "Automatic") and enter the secret in the key field. For RS256/RS384/RS512 tokens, select the type "RSA public key" and paste the key in PEM format. The result shows the algorithm badge, signature validity badge and warnings (e.g. token expired).
Algorithms and Security
JWT supports multiple signature algorithms.HS256/HS384/HS512are HMAC algorithms - the same secret (symmetric key) is used for signing and verification.RS256/RS384/RS512are RSA algorithms - the server signs with the private key, the client verifies with the public key (asymmetric). A value ofalg: nonemeans no signature and is unsafe for production. Always check theexp(expiration time) andiss(issuer) fields.Never paste production secrets orprivate keys into online tools - use sample values for testing.
FAQ
Does JWT decoding require a key?
No. The header and payload segments are only encoded in base64url - anyone can decode them without knowing the key. The key is only needed toverify thesignature, i.e. check that the token has not been modified. This is an intentional property of the standard: JWT is signed, not encrypted (unless you use JWE).
What does claim "exp" mean in a JWT?
Claimexp(expiration time) is a Unix timestamp that specifies when a token expires. The application should discard tokens whereexpis in the past. The tool displays a warning if the token has expired. Similarly, claimnbf(not before) indicates when the token is valid.
What is the difference between HS256 and RS256?
HS256 (HMAC-SHA256) uses one shared secret for signing and verification. RS256 (RSA-SHA256) uses a key pair: the server signs with the private key, and external parties can verify with the public key without access to the private key. RS256 is preferred in architectures with multiple services and federated identities (e.g. OIDC).
Is my data safe?
The tool runs entirely on the server side - the token is only processed during the current session and is not saved or shared. However, never paste production user data tokens or production key secrets into online tools. Always use sample or dedicated test tokens for testing.