InstaUtils

JWT Decoder – Inspect Token Header & Payload Online

Decode JWT tokens to view header and payload (no verification).

Enter a JWT token above to decode it

How to use this jwt decoder

  1. Paste a JWT (three Base64URL segments separated by dots) into the "Enter JWT Token" field
  2. The header and payload are decoded automatically as soon as you paste or type a valid token
  3. Review the decoded Header panel to see the token's algorithm and type
  4. Review the decoded Payload panel to see the claims, such as subject, issuer, or expiry
  5. Use the copy button on either panel to copy the formatted JSON for the header or payload
  6. If the token is malformed (not three dot-separated parts, or invalid Base64/JSON), an error message explains the problem

Frequently Asked Questions

What is a JWT token?

JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: header, payload, and signature.

Does this tool verify the JWT signature?

No. This tool only decodes the JWT to show the header and payload. It does not verify the signature or validate the token. Use this for debugging and inspection only.

Is my JWT token secure?

This tool processes JWTs entirely in your browser. Your tokens are never sent to any server. However, never share your JWT tokens publicly as they may contain sensitive information.

Related Tools

Base64 Encode/Decode

Encode and decode Base64 instantly. No terminal commands. Works for text, images, data. Free developer tool.

Open Tool →

JSON Formatter

Format and validate JSON instantly. Better than VS Code extensions—no install, works anywhere. Syntax highlighting included.

Open Tool →

A JWT decoder helps backend developers, API testers, and security engineers inspect the contents of JSON Web Tokens used for authentication and authorization. This tool is useful when debugging login flows, verifying that an API is issuing the claims you expect, or checking token expiry and scopes without writing custom decoding code. By pasting a JWT into the tool, you can instantly see the human-readable header and payload behind the encoded string, making it easier to troubleshoot session issues, inspect third-party tokens, or understand what data an identity provider embeds in its tokens. Everything is decoded locally in your browser, so sensitive tokens are never transmitted anywhere, which matters since JWT payloads often contain user identifiers or permission data.

What is jwt decoder?

A JWT decoder works by splitting a JSON Web Token into its three dot-separated segments: header, payload, and signature. The header and payload segments are Base64URL-encoded JSON strings, so the tool decodes each one using the browser's Base64 decoder and re-encodes the bytes as UTF-8 text before parsing it as JSON. The result is displayed as formatted, indented JSON so nested claims are easy to read. The signature segment is not processed at all, because verifying it would require the issuer's secret key or public key, which this client-side tool never has access to. This makes the tool ideal for quickly reading token contents, but it cannot confirm whether a token is authentic or has been tampered with.

Common use cases

  • Debugging why an authenticated API request is failing by inspecting the token's claims
  • Checking a token's expiry (exp) and issued-at (iat) timestamps during a login investigation
  • Verifying that an identity provider (Auth0, Firebase, Cognito, etc.) is issuing the expected custom claims
  • Inspecting a third-party or partner API's JWT to understand its structure before integrating with it
  • Confirming the signing algorithm (alg) in the header while debugging signature-verification code
  • Sharing a decoded, readable token payload with a teammate when reporting an authentication bug

Limitations and common mistakes

  • This tool only decodes a JWT; it does not verify the signature, so it cannot confirm a token is authentic or unmodified
  • It cannot tell you whether a token has expired or been revoked — you must read the exp claim yourself and check it against the current time
  • Tokens must have exactly three dot-separated segments; JWE (encrypted) tokens or other token formats are not supported
  • Malformed Base64URL padding or non-UTF-8 payloads will cause decoding to fail with a generic error
  • Because decoding happens instantly in the browser, no server-side validation such as issuer or audience checks is performed