Decode a JSON Web Token to read its header and claims, check whether it has expired, and verify or create a real HMAC signature. Everything runs on your device — no token is ever sent anywhere.
Header
Payload
What the claims mean
Signature
RS256 and ES256 need a private key and are out of scope here.
Header
Payload
Signed token
Everything runs on your device and nothing is transmitted. Even so, a JWT is a credential — avoid pasting a live production token into any web page, including this one, unless you can revoke it.
Frequently Asked Questions (FAQ)
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. They are commonly used for authentication, API access, and secure data exchange. A JWT is made up of three parts: a header, a payload, and a signature.
How can I decode a JWT online?
Simply paste your token into our free JWT decoder, click Decode, and the tool will instantly show you the header and payload in human-readable JSON format. No signup required.
Can I encode a JWT with this tool?
Yes. Switch to the Encode tab, enter your header and payload as JSON, and the tool will generate a new JWT string for you.
Do I need a secret to use this tool?
No. This version provides basic encoding and decoding. For most debugging and learning use cases, that’s all you need. Advanced signing and signature verification may be added in the future.
Is this JWT encoder/decoder free to use?
Yes, the tool is completely free. You can decode and encode JWTs as much as you want.
Why use a JWT decoder?
If you’re working with APIs, debugging authentication flows, or just learning JWTs, an online decoder is the fastest way to view the claims inside a token.