Jwt Decoder

Decode JSON Web Tokens to reveal their header and payload for debugging. No signup. Decoding is not verifying, and never paste real production tokens into any tool.

Remove Ads

Result

Header
Payload

Note: this decodes the token only. It does not verify the signature, which requires the secret key.

Remove Ads

Share on Social Media:

This JWT decoder decodes JSON Web Tokens to reveal their header and payload, directly in your browser, for debugging and understanding tokens. Paste a token to see its decoded contents. No account, no install. Note that decoding is not verifying a token's signature, and you should never paste real production or sensitive tokens into any online tool.

On this page

How to Decode a JWT Step by Step
What a JWT Is and How It Is Structured
Decoding Versus Verifying a Token
Who Uses a JWT Decoder
Pro Tips for Working With JWTs Safely
Common JWT Mistakes to Avoid
Related Tools You May Need Next
Frequently Asked Questions

How to Decode a JWT Step by Step

Paste the token. Paste the JSON Web Token you want to inspect into the input. Use test or example tokens for this, never real production or sensitive tokens.
The token is split. The tool splits the token into its parts, the header, the payload and the signature, which are separated within the token's structure.
View the decoded header. The header is decoded and shown, revealing information about the token, such as the type and the algorithm indicated for its signature.
View the decoded payload. The payload is decoded and shown, revealing the claims, the data the token carries, such as identifiers and other information encoded within it.
Use it for debugging. Inspect the decoded contents to understand or debug the token, seeing what data it contains, while remembering decoding does not verify it.

JWT decoder showing a token's header and payload

What a JWT Is and How It Is Structured

A JSON Web Token, or JWT, is a compact, self contained way of representing information to be transferred between parties, widely used in web authentication and authorisation. A JWT carries a set of claims, pieces of data, in a structured form, and is commonly used to represent that a user is authenticated, passing this securely between a server and a client. Understanding what a token contains is often necessary when developing and debugging such systems.

A JWT has three parts, separated within the token: the header, the payload and the signature. The header describes the token, including the algorithm used for its signature. The payload contains the claims, the actual data the token carries, such as user identifiers and other information. The signature is used to verify that the token has not been tampered with and comes from a trusted source. These three parts together make up the token.

Never paste real production or sensitive tokens. Because a JWT's payload is encoded, not encrypted, anyone with the token can read its contents. Never paste real production or sensitive tokens into any online tool, as this could expose the data they carry. Use only test or example tokens for decoding and learning.

A crucial point is that the header and payload of a JWT are encoded, not encrypted. This means anyone can decode and read them, since the encoding is a reversible, standard format, not a secret one. A JWT decoder simply reverses this encoding to show the header and payload contents. This is why a JWT should never carry secret information in its payload, and why decoding a token reveals its data to anyone who has it.

The most important distinction is between decoding and verifying a token. Decoding reveals the header and payload contents, which anyone can do, but it says nothing about whether the token is genuine and untampered. Verifying involves checking the signature, which requires the secret or key and confirms the token's authenticity and integrity. A decoder only decodes; it does not and cannot verify. So decoded contents show what a token claims, not that those claims are trustworthy.

Decoding Versus Verifying a Token

Aspect	Decoding	Verifying
Reveals	Header and payload contents	Whether the token is genuine
Needs	Just the token	The secret or key
Anyone can	Yes, contents are encoded not encrypted	No, needs the key
This tool does	Decoding only	Not verification

Who Uses a JWT Decoder

Developers debugging authenticationA developer working on authentication decodes a test token to see its claims, understanding what data it carries while debugging the system.

People learning about JWTsSomeone learning how JSON Web Tokens work decodes example tokens to see their structure, the header, payload and claims, building understanding.

People inspecting token contentsA developer who needs to see what claims a token contains, for a test or example token, decodes it to inspect the payload's data.

People troubleshooting token issuesSomeone whose authentication is not behaving as expected decodes a test token to check whether its claims are as intended, aiding diagnosis.

Anyone understanding a token's dataA developer wanting to see the data inside a JWT, using test tokens, decodes it to reveal the header and payload contents for inspection.

Developer inspecting a test token's claims for debugging

Pro Tips for Working With JWTs Safely

Only use test or example tokens. Never paste real production or sensitive tokens into any online tool, since the payload is readable once decoded. Use test or example tokens for decoding and learning, keeping real tokens secure.

Remember decoding is not verifying. Decoding reveals a token's contents but says nothing about whether it is genuine. Verifying requires checking the signature with the secret or key. Never treat decoded contents as proof a token is valid or trustworthy.

Never put secrets in a JWT payload. Because the payload is encoded, not encrypted, anyone with the token can read it. Never place secret or sensitive information in a JWT payload, since it is not hidden, only encoded in a readable, reversible format.

Use decoding to understand token data. Decoding is genuinely useful for seeing what claims a token carries when developing and debugging, letting you inspect the header and payload to understand or troubleshoot your authentication.

Verify signatures in your code properly. Actual verification of a token's authenticity must happen securely in your code with the proper key, not in a decoder. Ensure your system verifies signatures correctly, which is what establishes a token's trustworthiness.

Handle real tokens securely. Real JWTs used in authentication should be handled securely, transmitted over secure connections and stored safely, never exposed in tools, logs, or insecure places, since they can grant access if obtained by others.

Common JWT Mistakes to Avoid

Pasting real production tokens into online tools. Because a JWT's payload is encoded, not encrypted, pasting a real token into any online tool exposes its contents and risks the token itself. Never do this with production or sensitive tokens; use only test or example tokens for decoding, keeping real tokens secure.

Thinking decoding verifies a token. Decoding reveals a token's contents but does not verify its authenticity or integrity. Verifying requires checking the signature with the secret or key. Treating a successfully decoded token as verified is a serious mistake, since anyone can decode a token regardless of whether it is genuine.

Putting sensitive data in the payload. The JWT payload is encoded, not encrypted, so anyone with the token can read it. Placing secret or sensitive information in the payload, assuming it is hidden, exposes that data. Only non secret claims belong in a payload, since its contents are readable by anyone who has the token.

Handling real tokens carelessly. Real JWTs can grant access, so exposing them in tools, logs, or insecure storage risks their misuse by anyone who obtains them. Handle real tokens securely, transmitting them over secure connections and storing them safely, rather than treating them as ordinary, exposable data.

For working with the JSON in a token payload, our JSON tools help format and inspect it. To decode other encodings, the Base64 tools and related decoders are available for different formats.

Decoded JSON Web Token header and payload

Frequently Asked Questions

How do I decode a JWT?

Paste the JSON Web Token, using a test or example token rather than a real one, into the input, and the tool splits it into its three parts and decodes the header and payload, showing their contents. The header reveals information like the algorithm, and the payload reveals the claims, the data the token carries. This lets you inspect what a token contains for debugging or learning. Remember that decoding only reveals the contents; it does not verify that the token is genuine, which requires checking the signature.

What is a JWT?

A JSON Web Token, or JWT, is a compact, self contained way of representing information to be transferred between parties, widely used in web authentication and authorisation. It carries a set of claims, pieces of data, in a structured form, and is commonly used to represent that a user is authenticated, passing this between a server and client. A JWT has three parts: the header, describing the token; the payload, carrying the claims; and the signature, used to verify the token's authenticity and integrity.

What is the difference between decoding and verifying a JWT?

Decoding reveals a token's header and payload contents, which anyone can do since these parts are encoded, not encrypted. It shows what the token claims but says nothing about whether the token is genuine. Verifying involves checking the token's signature, which requires the secret or key, and confirms the token's authenticity and integrity, that it has not been tampered with and comes from a trusted source. A decoder only decodes; it does not verify. So decoded contents show what a token claims, not that those claims are trustworthy.

Is a JWT payload encrypted?

No, and this is crucial to understand. The header and payload of a JWT are encoded, not encrypted, using a standard, reversible format. This means anyone who has the token can decode and read the header and payload contents; they are not secret. This is why a JWT should never carry secret or sensitive information in its payload, since it is readable by anyone with the token. The signature provides integrity, allowing verification that the token is untampered, but it does not make the payload contents secret or hidden.

Is it safe to paste a token into a JWT decoder?

You should never paste real production or sensitive tokens into any online tool. Because a JWT's payload is encoded, not encrypted, its contents are readable once decoded, and exposing a real token could compromise the data it carries or the token itself. For decoding and learning, use only test or example tokens, never real ones. Real tokens should be handled securely and kept private, since they can grant access if obtained by others. This decoder is intended for test and example tokens for debugging and understanding.

Why should I never put secrets in a JWT payload?

Because the payload is encoded, not encrypted, so anyone who has the token can decode and read its contents. If you place secret or sensitive information in the payload, thinking it is hidden, that information is actually readable by anyone who obtains the token. Only non secret claims, the kind of data that is acceptable for anyone with the token to see, belong in a JWT payload. Secrets must be kept elsewhere, secured properly, never encoded into a token payload where they are exposed to anyone holding the token.

Can a JWT decoder tell me if a token is valid?

No, a decoder cannot tell you whether a token is valid or genuine. It only decodes and displays the header and payload contents, which anyone can do regardless of whether the token is authentic. Determining validity requires verifying the signature, which needs the secret or key and confirms the token is untampered and from a trusted source. This verification must happen securely in your code, not in a decoder. So a successfully decoded token is not a verified token; decoding and verifying are entirely different things.

Is the JWT decoder free?

Yes, it is completely free with no account and no usage limit. You can decode as many test or example JSON Web Tokens as you like, as often as you like, at no cost. It runs in your browser on any device, so there is nothing to download or install, and the decoded header and payload appear instantly whenever you paste a token. Remember to use only test or example tokens, never real production or sensitive ones, since a token's payload is readable once decoded.