Decode and inspect JWT tokens instantly. View header, payload and expiry.
Invalid JWT token. Please check the format.
JWT stands for JSON Web Token. It is an open standard for securely transmitting information between two parties as a JSON object. JWTs are commonly used for authentication and authorization in web applications and APIs.
A JWT token has three parts separated by dots. Each part is Base64URL encoded.
Header — Algorithm type and token type
Payload — Claims data such as user ID, roles, and expiry time
Signature — Verifies the token has not been tampered with
Decoding a JWT only reads the header and payload — it does not verify the signature. The payload data is Base64 encoded, not encrypted, so it can be read by anyone. Never put sensitive data like passwords inside a JWT payload. This tool decodes entirely in your browser — no data is sent to any server.