JWT Decoder Online — Decode JSON Web Tokens Free
Paste a JWT to read its header and payload. Decoding happens in your browser — the token is never uploaded.
Everything runs in your browser — your input is never uploaded.
How to decode a JWT
- 1
Paste your token
Paste the full JWT (header.payload.signature) into the input box.
- 2
Read the claims
The decoded header and payload appear on the right as formatted JSON.
- 3
Copy what you need
Copy the decoded output or download it as a text file.
Why use this tool
Files never leave your device
Everything runs inside your browser. Nothing is uploaded, stored or seen by anyone but you.
No signup, no watermark
No account, no email, no branding stamped on your output. Free with no daily limit.
Instant — no upload wait
Because there is no round trip to a server, results appear as fast as your device can work.
Works on your phone
Built mobile-first, so you can do this from a phone browser without installing anything.
Reading a JWT safely
A JWT carries claims — who issued it, who it is for, when it expires — as Base64URL-encoded JSON. Because the payload is only encoded, not encrypted, anyone can read it, which is exactly what this tool does locally. Treat everything in a JWT as public, and never put secrets in the payload.
Frequently asked questions
- Does this verify the signature?
- No. This tool decodes the header and payload so you can read the claims; it does not verify the signature or trust the token. Never rely on an unverified token for authorization.
- Is my token sent to a server?
- No. Decoding runs entirely in your browser, so it is safe to paste real access tokens — they never leave your device.
- Why can't my token be decoded?
- A JWT must have at least a header and payload separated by dots, each Base64URL-encoded JSON. If decoding fails, the token is malformed or truncated.
Related tools
Keep going — these pair well with what you just did.