JWT Encoder Decoder
A JSON Web Token is three Base64URL parts: header, payload, and signature. This tool decodes the header and payload so you can read claims such as exp, sub, and iss, and it can sign a token when you supply a key. Decoding never proves the token is authentic. Verification needs the right secret or public key.
How to use the JWT Encoder Decoder
- Paste the token. Use the full value, including both dots. A token copied from an Authorization header should not include the Bearer prefix.
- Read the header and payload. The header names the algorithm. The payload is the claims set. Check exp against the current time before you trust a session.
- Verify only if you have the key. Choose the algorithm and provide the HMAC secret or the PEM key. A mismatch means the signature does not match that key, not that the payload was edited in some other way.
When it helps
- Debug a failed login. See whether the API issued a short-lived token, the wrong audience, or a missing scope before you change application code.
- Confirm what a service signed. When you control the signing key, verify HS256 or an RSA/EC algorithm from the dropdown instead of trusting a decoded payload alone.
Common questions
Can I tell if a JWT is forged just by decoding it?
No. Anyone can change the payload and re-encode it. The signature only checks out when verification succeeds with the expected key.
What does alg: none mean?
Some broken verifiers once accepted unsigned tokens. Treat alg none as untrusted. This page will not help you bypass a server that correctly rejects it.
Which algorithms can I sign with?
HMAC (HS256, HS384, HS512) with a shared secret, and RSA or ECDSA (RS* and ES*) when you provide the matching PEM key.
Is it safe to paste a production token here?
Processing stays in the browser, but the token is still a credential. Prefer a short-lived token and a private machine.
Why is the payload not readable JSON?
The segment is Base64URL. If it still fails, the token was truncated or it is JWE (encrypted), which this decoder does not open.
Read the guide: JWT Decoder Online: Inspect Token Headers, Payloads, and Claims Instantly