JWT Decoder
Decode JWT tokens to view the header and payload instantly — inspect claims without verifying the signature. Free, client-side JWT decoder viewer.
🔒 100% Client-Side Processing
Your data is processed entirely in your browser and never transmitted to any server.
0 / 100M Limit
Common Use Cases
Debugging authentication failures
Decode the token your app actually sent to check its expiry, audience, and scopes when requests come back 401.
Verifying token contents
Confirm your auth server put the right claims — roles, user ID, tenant — into the tokens it issues.
Learning JWT structure
See exactly how header, payload, and signature compose a real token when implementing auth for the first time.
Frequently Asked Questions
- How does JWT decoding work without the secret key?
- A JWT's header and payload are just URL-safe Base64-encoded JSON — no key is needed to read them. The tool splits the token on dots and decodes the first two segments with atob(). Only the third segment (the signature) requires the secret.
- Does this tool verify the JWT signature?
- No — it is a viewer, not a verifier. It shows you the claims but cannot prove the token is authentic or untampered. Always verify signatures server-side with the issuer's key before trusting any claim.
- Is it safe to paste a production token here?
- Decoding happens locally, so the token is never transmitted. Still, treat live access tokens carefully as a habit: prefer expired or development tokens when debugging, since JWTs are bearer credentials.
- Why did I get "Invalid JWT encoding" on a real token?
- JWT segments use base64url encoding (- and _ instead of + and /), which this tool now converts before decoding — if you still see this error, the token likely isn't a valid 3-part JWT (header.payload.signature), or the payload itself isn't base64url-encoded JSON.
- Can this create a new JWT instead of just decoding one?
- Not on this page — this tool only inspects existing tokens. Use the JWT Generator to build and sign a new token from a custom header, payload, and HS256 secret.
- Is my data private when I use this tool?
- Yes. This tool runs entirely in your browser using client-side JavaScript — nothing you type is transmitted to, logged by, or stored on any server. You can safely process confidential text, tokens, or code.