How do I decode a JWT online?

Paste the full token (header.payload.signature) into the decoder above. It base64url-decodes the first two segments and shows the header and payload claims as readable JSON — free, no signup, processed entirely in your browser.

What is a JWT parser?

A JWT parser splits a compact token on its dots and decodes the base64url-encoded header and payload into readable JSON. This tool is a JWT parser: it shows the algorithm, type, and every claim in the token — but it does not verify the signature.

How can I decode a JSON Web Token without the secret?

You can decode (read) any JWT without the secret because the header and payload are only base64url-encoded, not encrypted. Paste the token above to see the claims. Important: decoding is not verification — only someone with the secret or public key can verify the token is authentic.

What does a JWT debugger show me?

A JWT debugger shows the decoded header (algorithm, token type, key id) and payload (subject, issuer, issued-at, expiry, and custom claims) of a token. This tool shows exactly that. Use a debugger to inspect what a token carries — never to decide whether to trust it.

How do I view JWT claims?

Paste the token into the decoder and read the Payload output — every claim (sub, name, email, iat, exp, plus any custom ones) is listed as JSON. Remember the signature is not verified here, so treat the claims as informational only.

JWT Decoder — Decode and Inspect JWT Claims

What is Jwt decoder?

JWT Decoder — Decode any JWT with this free JWT decoder — view header and payload claims in your browser. No signup, nothing uploaded; signature never verified.

Decoding only — no signature verification, no claim validation. The token is split on dots, the header and payload segments are base64url-decoded and JSON-parsed by the vendored jose engine (panva/jose, MIT) using its decodeProtectedHeader and decodeJwt functions, exactly as the library documents them: decoding without authenticating. Everything runs client-side in your browser; the token is never uploaded. Limitation: an expired or forged token still "decodes" fine — decoding says nothing about trust.

Why use this jwt decoder?

🎯

Built for jwt decoder

Decode any JWT with this free JWT decoder — view header and payload claims in your browser. No signup, nothing uploaded; signature never verified.

📋

Transparent & honest

Signature is NOT verified — decoding is not authentication; an expired or tampered token still decodes successfully.

🔒

Private by design

Everything runs in your browser. Your inputs never leave your device.

📱

Works everywhere

Fully responsive — perfect on desktop, tablet, and mobile. No app needed.

🔄

Regularly updated

Regularly maintained and reviewed to ensure accuracy.

💡

Free forever

No accounts, no limits, no watermarks. Use JWT Decoder as much as you need.

How to use JWT Decoder

1Paste your JWT into the "JWT token" box — the full three-part token (header.payload.signature).
2Run the tool to base64url-decode the header and payload segments.
3Read the Header output for the algorithm (alg), type (typ), and key id (kid) if present.
4Read the Payload output for the claims: sub, name, iat, exp, and any custom claims.
5Check the expiry claim (exp) yourself — this tool only decodes and never validates or verifies anything.

What can you do with JWT Decoder?

Decode jwt online — Decode any JWT with this free JWT decoder — view header and payload claims in your browser.
Jwt parser — Decode any JWT with this free JWT decoder — view header and payload claims in your browser.
Decode json web token without secret — Decode any JWT with this free JWT decoder — view header and payload claims in your browser.
View jwt claims — Decode any JWT with this free JWT decoder — view header and payload claims in your browser.

Good to know

Signature is NOT verified — decoding is not authentication; an expired or tampered token still decodes successfully.
Only compact JWS serialization (three dot-separated parts) is supported; encrypted JWE tokens cannot be read this way.
Decoding happens in your browser and nothing is uploaded, but a JWT can contain sensitive claims — avoid pasting real production tokens into any online tool.

How it works

Decoding only — no signature verification, no claim validation. The token is split on dots, the header and payload segments are base64url-decoded and JSON-parsed by the vendored jose engine (panva/jose, MIT) using its decodeProtectedHeader and decodeJwt functions, exactly as the library documents them: decoding without authenticating. Everything runs client-side in your browser; the token is never uploaded. Limitation: an expired or forged token still "decodes" fine — decoding says nothing about trust.

Examples

Standard HS256 token

Status: ok — header shows alg HS256 / typ JWT; payload shows sub, name, and iat claims.

Token with expiry claim

Status: ok — payload includes exp 1893456000; the tool reports the claim but does not check whether it is expired.

Truncated token

Status: error — a complete three-part compact JWT is required; two segments cannot be decoded.

People also search for these — this tool handles them all:

jwt decoderdecode jwt onlinejwt parserdecode json web token without secretview jwt claims