How do I decode a JWT?

Paste the token into the box. The header and payload are Base64URL encoded JSON, so the decoder converts them back to readable text and shows the claims.

Is it safe to decode a JWT online?

This decoder runs entirely in your browser and sends nothing to a server. You should still avoid pasting live production tokens into sites you do not trust.

Does decoding a JWT check the signature?

No. Decoding only reads the contents. Add a secret, public key or JWK in the verify box to check that the signature is valid.

Why does my token say it has 5 parts?

A token with five parts is an encrypted JWE, not a signed JWT. Its contents cannot be read without the decryption key.

JWT Decoder: Decode and Verify JSON Web Tokens Online (Free)

Paste a JSON Web Token and read its header, payload and signature at once. Time claims show as real dates, and you can check the signature with a secret or public key.

What the JWT decoder does

A JSON Web Token is three Base64URL strings joined by dots. The decoder splits them, turns the header and payload back into readable JSON, and shows time claims such as exp and iat as real dates. It also checks the signature when you give it a secret or a public key.

How to decode a JWT

Paste the token. A leading Bearer prefix and surrounding quotes are removed for you.
Read the header to see the algorithm and the key ID.
Read the payload to see who the token is for and when it expires.
Optionally add a key in the verify box to confirm the signature.

Decoding is not verifying

Anyone can decode a JWT, because the first two parts are only encoded. Decoding tells you what a token claims. Only signature verification tells you that the claims came from the key holder and were not changed. The verify box accepts an HMAC secret, a PEM public key that starts with BEGIN PUBLIC KEY, or a JWK. It supports the HS, RS, PS and ES algorithms.

Why a token will not decode

It does not have exactly three parts. A five-part token is encrypted (JWE) and cannot be read without the key.
It was cut off when copied, or has extra characters in it.
It is an opaque token, a random string that is not a JWT at all.

Privacy

Decoding and verifying run in your browser with the Web Crypto API. Nothing is sent to a server. Even so, treat live access tokens like passwords and avoid pasting them into websites you do not control.

Related tools

Check only the dates with the expiration checker, review security with the JWT inspector, or create a token with the JWT encoder. New to the format? Read what a JWT is.

JWT Decoder

Verify the signature (optional)