JWT Decode
Client-sidePopularFeaturedNewDecode JWT header and payload in your browser — inspect claims without uploading tokens.
JWT Decode shows a token’s header and payload in your browser. It does not verify signatures — treat claims as untrusted display data.
Processed in your browser — data stays on your device
Key takeaways
- Decode header and payload locally
- Shows iat / exp / nbf as ISO times when present
- Signature is not verified
- Tokens are not uploaded
What is a JWT?
A JSON Web Token is a compact, Base64URL-encoded structure (typically header.payload.signature) used to carry claims between parties.
Decoding reads the JSON segments. Verification checks the signature with a key and algorithm. This page only decodes. Never trust exp, roles, or other claims from an unverified token in production logic.
Features
Header & payload JSON
Pretty-prints decoded segments with algorithm and claim fields.
Claim helpers
Shows issued-at, expiry, and not-before as ISO timestamps when present.
Bearer prefix tolerant
Paste Authorization: Bearer … values; the prefix is stripped.
Private by default
Tokens stay on your device — never POSTed to a server.
How it works
Paste a JWT
Use a compact token (header.payload.signature) from logs or DevTools.
Decode
Base64URL segments are decoded to JSON. Signature bytes are not verified.
Inspect claims
Review alg, sub, exp, and custom claims in the formatted output.
Example walkthroughs
Sample HS256-shaped token
Decodes a classic demo token into header, payload, and signature metadata.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Common JWT registered claims
| Claim | Meaning |
|---|---|
| iss | Issuer |
| sub | Subject (who the token is about) |
| aud | Audience |
| exp | Expiration time (Unix seconds) |
| nbf | Not-before time |
| iat | Issued-at time |
| jti | JWT ID |
Use cases
Debug auth failures
Confirm expiry and audience claims when APIs return 401.
Inspect SSO cookies
Read payload fields from session JWTs during local development.
Document APIs
Show example claim shapes in internal runbooks.
Code snippets
Split a compact JWT
jsJWT Decode performs this split and pretty-prints header + payload.
const [header, payload] = token.split("."); // decode each Base64URL segment → JSON
Common errors
Invalid JWT format
Cause: The token is missing segments or is a JWE / opaque string.
Fix: Paste a compact JWS with header.payload.signature (two or three parts).
Claims look trusted but auth still fails
Cause: This tool does not verify signatures.
Fix: Validate signatures with your auth library; use decode only for inspection.
About JWT Decode
JWT Decode inspects a JSON Web Token’s header and payload so you can debug auth flows, expiry, and claims without leaving the browser.
This tool does not verify signatures — treat decoded claims as untrusted display data only.
Frequently asked questions
Does this verify the signature?
No. Decoding only. Never trust claims from an unverified token in production logic.
Is my JWT uploaded?
No. Decoding runs in your browser. Still avoid pasting production secrets on shared machines.
What about encrypted JWTs (JWE)?
This tool targets compact JWS (three segments). Encrypted tokens are not supported.
Related tools
UUID Generator
Generate UUID v4 identifiers in bulk — uppercase and hyphenless options, fully client-side.
Base64 Encode / Decode
Encode UTF-8 text to Base64 or decode Base64 back to text — instantly in your browser.
JSON Formatter
Format, beautify, and minify JSON in your browser. Free, private, and instant — no upload to a server.
Popular tools
JSON Validator
Validate JSON instantly in your browser. See type, size, and node counts — or exact parse errors with line and column.
JSON Viewer
Explore JSON as an interactive tree with paths, types, and expandable nodes — all processed locally in your browser.
URL Encode / Decode
Percent-encode text for URLs or decode encoded query strings — private and instant.
Hash Generator
Generate SHA-1 / SHA-256 / SHA-384 / SHA-512 digests of text with Web Crypto — fully client-side.
Newest tools
Base64 Encode Text
Encode plain text notes, messages, and Unicode strings to Base64 in your browser — private and instant.
Base64 Encode JSON
Encode JSON payloads to Base64 for APIs, JWTs, and transport — decode back to UTF-8 JSON in your browser.
Base64 Encode HTML
Encode HTML fragments and markup to Base64 for data URLs, emails, and embeds — decode back in your browser.
Base64 Encode URL
Encode URLs and query strings to Base64 for opaque links and redirects — distinct from percent-encoding.
Explore more
Guides & articles
How to decode a JWT safely (without trusting claims)
Inspect JWT header and payload in your browser. Learn why decoding is not verification, and which claims matter when debugging auth.
Keyboard shortcuts
Common keyboard shortcuts for Tools by RS Roshi workspaces — format, copy, reset, and global search.
Privacy model (client-side tools)
How Tools by RS Roshi handles data: browser-first processing, what we do not upload, and how that claim maps to product behavior.
JWT inspection notes on the RS Roshi blog
Practical write-ups around jwt inspection.
Platform documentation
Shortcuts, limits, and how client-side tools work.