How to Decode a JWT (JSON Web Token)
Published September 11, 2026 · 3 min read
A JWT looks like gibberish at a glance, but it's really just three base64-encoded sections — a header, a payload, and a signature — separated by dots. This tool decodes the header and payload so you can see exactly what claims and metadata a token actually contains.
Try JWT DecoderSteps
- 1
Open the JWT Decoder tool
Go to the JWT decoder.
- 2
Paste your JWT
Paste the full token string, including all three dot-separated sections.
- 3
Decode
The header and payload are decoded and shown as readable JSON.
- 4
Review the claims
See exactly what data — user ID, expiry, roles — the token encodes.
Frequently asked questions
No — this decodes and displays the readable content of the header and payload; it doesn't verify the signature, which would require the signing secret or key.
The decoding happens entirely in your browser and nothing is sent anywhere, but as a general practice, avoid pasting live production tokens into any tool unless you trust exactly how it processes them — this one keeps everything local.
The signature isn't meant to be human-readable — it's a cryptographic value used to verify the token wasn't tampered with, not encoded data to decode.
Because decoding runs entirely client-side, you can inspect a token's claims while debugging an auth flow without it touching any server but your own.