JWT Decode: Free Online JWT Decoder — How-To Guide

A JSON Web Token (JWT) looks like a long string of random characters, but its first two parts are readable once decoded. ToolsFam's JWT Decode tool reads a token's header and payload in your browser, so you can see what a token actually contains — which algorithm it declares, who it was issued to, and when it expires — without uploading it anywhere.

Try it free: JWT Decode

What the tool does

JWT Decode decodes the header and payload of a JWT locally, without verifying the token or uploading it to a server. A JWT has three parts separated by dots: header, payload, and signature. The tool decodes the first two, which are Base64URL-encoded JSON, and presents them in readable form.

This is useful when debugging an API, inspecting a token your app received, or learning how JWTs work. Decoding only reads the token: it does not prove it is genuine, unexpired, or trustworthy. Signature verification requires the correct secret or public key, and is a separate step your application or API server performs.

How to use it, step by step

1. Open the tool. Go to the JWT Decode page linked above. You will see a single input field labelled "JWT token to decode".
2. Paste the full token. Copy the complete token, including all three dot-separated parts, and paste it into the input field. Make sure you have not cut off the beginning or end, and remove any stray spaces or line breaks around it.
3. Read the header. The decoded header tells you how the token was made. Look for the alg field, which names the signing algorithm, and the typ field, which usually says JWT. If your system expects one algorithm and the header declares another, that mismatch is worth investigating before you go further.
4. Read the payload claims. The payload holds the claims — the actual information carried by the token. Common claims include sub (the subject, often a user ID), iss (the issuer), aud (the intended audience), iat (when the token was issued), and exp (when it expires).
5. Check the expiry. Compare the exp value with the current time. The exp claim is a Unix timestamp, in seconds since 1 January 1970. If that time has already passed, the token is expired, and most APIs will reject it even if everything else looks right.
6. Compare against what you expected. Check that the issuer, audience, and subject match the service and user you are testing. A token issued for one environment or audience showing up in another is a common cause of "unauthorized" errors.
7. Copy what you need. Use the decoded output to compare claims with your API's documentation or your own code, then clear the field when you are done, especially on a shared computer.

Practical tips

• Start with a test token, not a production one. When you are learning or debugging, use a token from a development environment. Production tokens can contain sensitive information, and even though this tool runs locally, it is good practice not to paste real user tokens into any tool you do not need to.
• A broken decode usually means a broken copy. If the output looks garbled or the tool cannot decode the token, check for a missing section first. A valid JWT has exactly three parts separated by two dots. Extra whitespace, a trailing period, or a token pasted from a wrapped log line are the usual culprits.
• Decoded does not mean trusted. Anyone can decode a JWT's header and payload — that is by design, since those parts are only encoded, not encrypted. Never treat a readable payload as proof that a token is valid, and never put secrets, passwords, or private data into a token payload expecting them to stay hidden.

FAQ

Does JWT Decode verify the token's signature?
No. Decoding only reads the header and payload. Signature verification requires the correct secret or public key and is done by your application or API server, not by this tool.

Is decoding the same as decrypting a token?
No. The header and payload of a standard JWT are Base64URL-encoded, not encrypted, so anyone holding the token can decode and read them. If a token must keep its contents private, it needs to be encrypted (a JWE), not just signed.

Why does my decoded output look broken?
The input may be incomplete, double-encoded, or copied with extra characters. Check that the token has three dot-separated parts, strip surrounding whitespace, and try pasting it again from the original source rather than from a formatted document.

Can I use this tool to check why an API rejects my token?
Yes, as a first step. Decoding lets you confirm the issuer, audience, subject, and expiry are what you expect. If all of those look right and the API still rejects the token, the problem is more likely the signature, the secret or key, or the API's own validation rules.

Privacy note

JWT Decode runs 100% in your browser — your token never leaves your device. Nothing you paste is uploaded to ToolsFam servers. That said, tokens can carry sensitive information, so decode only tokens you are allowed to inspect, and avoid sharing token payloads publicly.

Try it free: JWT Decode