JWT Decoder
Read the header and payload of a JWT.
How to use JWT Decoder
Decode a JSON Web Token header and payload. Inspection only — never paste a secret key.
Open JWT Decoder on toolpermarket and fill in the inputs the tool asks for.
In the Token field, paste the JSON Web Token, including its three dot-separated parts. No secret needed — decoding only reads the public payload.
In the View field, read the decoded header and payload as formatted JSON. The signature is shown but not verified here; verification needs the server secret.
Press Decode to compute the result. The output appears immediately below the form. Adjust the inputs and recalculate as many times as you need.
Read the result and use it as needed. If the number looks off, re-check your inputs and run it again — the math is deterministic, so the same entries always return the same answer.
Worked example. Decoding eyJ...[token] reveals {"sub":"123","name":"Ada","role":"admin"} from the payload part without needing the signing key.
Tips for accurate results.
Decoding is read-only; it proves nothing about validity.
Never paste a real token into any site you do not trust.
Check the exp claim to see if it has expired.
When to use JWT Decoder. Inspecting what an API actually put in a token. Debugging why a request is rejected as unauthorized. Learning the structure of header, payload and signature.
When you actually reach for this
- You received a JWT and need to inspect its payload (claims, expiry, issuer) without verifying the signature.
- You are debugging auth and want to see what the token actually contains before it is rejected.
Where this tool stops being accurate
- Decoding is not verifying — anyone can read the payload; it proves nothing about authenticity until the signature is checked with the secret.
- A token with an expired exp is still decodable; decoding does not tell you it is valid, only what it says.
Frequently asked questions
Does decoding verify the token is valid?
No. Decoding only base64-url-decodes the header and payload so you can read them; it performs no signature verification. A token could be forged and still decode cleanly. Real verification requires the server's secret or public key and must happen server-side, never in the browser alone.
Is it safe to paste my token here?
The decode runs entirely on your device and nothing is sent anywhere, so a token you paste is not transmitted. That said, treat any real credential carefully: avoid pasting production tokens into unfamiliar tools, and rotate a token if you suspect it was exposed.
What are the three parts of a JWT?
A JWT has a header describing the algorithm, a payload of claims such as subject and expiry, and a signature binding the two using a secret or key. The first two are plain base64url and readable; only the third proves authenticity, which is why reading the payload tells you the contents but not whether they are trustworthy.
Is it safe to decode a JWT from a user?
Reading it is fine and reveals the claims, but never trust those claims without verifying the signature server-side. Treat the payload as untrusted input.
The payload shows expired — does decode fail?
No. Decoding only base64url-decodes the middle segment; expiry is just a claim your verifier enforces separately.