How to decode a JWT
- Copy a JWT from your app's logs, network tab or Authorization header and paste it above.
- The header and payload decode automatically as soon as the token is complete.
- Read the payload — this is where claims such as
sub(subject),exp(expiry) androlelive. Timestamp claims are converted to readable dates for you.
A JWT has three dot-separated parts: header (algorithm & type), payload (the claims) and signature. Only the first two are shown decoded here.
What a JWT is
A JSON Web Token is a compact, signed way to pass claims between a server and a client — typically used for authentication and authorization. The header and payload are just Base64Url-encoded JSON (readable by anyone), and the signature proves they were not tampered with. Decoding a token requires no secret: that is why this tool can show you the contents safely. Verifying the signature does require the secret — which this tool never asks for and never does.
Common claims you'll see
iss— issuer: who created the token.sub— subject: the user or entity the token is about.aud— audience: who the token is intended for.exp— expiry time (Unix seconds): after this the token must not be accepted.nbf— not before: token is not valid before this time.iat— issued at: when the token was created.jti— unique ID for the token.
Frequently asked questions
Is it safe to paste a JWT here?
Yes — safer than most places, because decoding happens locally in your browser and nothing is transmitted. Still, a JWT is a credential; the safest habit is to decode test tokens, and to paste real tokens only on tools you trust (like this one, which works offline).
Why can't this tool verify my signature?
Verifying an HMAC or RSA signature requires the server's secret key (for HS*) or public key (for RS*/ES*). This tool is designed for inspecting tokens you already have; verification belongs in your backend, where the key lives. Never paste a secret into an online tool.
Why does my token show an error or garbage?
The token may be truncated or contain characters from being copied incorrectly. A valid JWT has exactly two dots and uses Base64Url (with - and _). If the payload was not JSON (some tokens carry raw data), it is shown as decoded text instead.
What is the difference between a JWT and a session cookie?
Cookies are opaque and managed by the browser; JWTs are self-contained, readable JSON the server can validate without a lookup. JWTs are common in APIs and SPAs. This topic only matters for how you store the token — do not store secrets in JWTs, they are not encrypted.