JWT Payload Decoder
Decode and inspect a JWT token's header and payload instantly. Free, runs in your browser.
How to use this tool
- Enter jwt token in the fields above.
- Results update instantly as you type — or click Calculate.
- Read your decoded payload and the full breakdown beneath it.
JSON Web Tokens (JWT) consist of three Base64URL-encoded parts. This tool decodes the header and payload so you can inspect the claims.
How it works
A JSON Web Token (JWT) is a compact, URL-safe string made of three Base64URL-encoded sections separated by dots: the header (algorithm and token type), the payload (claims such as user ID, roles, and expiry), and the signature. This tool decodes the header and payload so you can read the claims without needing to verify the signature.
Paste a JWT into the input field and the tool immediately shows the decoded JSON for both sections in a readable format. This is useful for debugging authentication issues, inspecting which claims an ID token carries, or checking expiry timestamps during development.
The tool does not verify the signature. For production systems you should always validate the signature using your identity provider's public key. Decoding alone tells you the contents, but not whether the token is trustworthy.
No token data is sent to any server. Everything runs in your browser, so it is safe to paste real tokens from your development environment.
Worked example
Inspect an OAuth ID token
- After signing in via OAuth, capture the id_token from the token response.
- Paste the full token string (starting with 'eyJ...') into the JWT field.
- The header section shows the algorithm (e.g. RS256) and key ID.
- The payload section shows claims: sub (user ID), email, exp (expiry Unix timestamp), and iat (issued-at).
- Check the exp value against the current Unix time to confirm the token has not expired.
Readable JSON objects for the header and payload, making all claims visible at a glance.
Common mistakes to avoid
- Trusting a decoded JWT without verifying the signature -- decoding only reads the claims; it does not confirm the token is authentic.
- Confusing the exp claim (Unix timestamp in seconds) with milliseconds -- multiply by 1000 before passing to JavaScript's Date constructor.
- Pasting only the payload segment instead of the full three-part token -- the tool expects the complete 'header.payload.signature' string.
Key terms
- JWT
- JSON Web Token -- a self-contained token format encoding claims as JSON, Base64URL-encoded, and signed to prevent tampering.
- Claim
- A key-value pair in the JWT payload representing a statement about the subject, such as the user's ID (sub), email, or token expiry (exp).
- Base64URL
- A variant of Base64 encoding that uses '-' and '_' instead of '+' and '/' so the encoded string is safe to use in URLs without percent-encoding.
Frequently asked questions
- Is it safe to decode JWTs here?
- Yes — decoding only reads the header and payload which are not secret. The signature is not verified but is also not exposed beyond what is in the token itself.