JWT Decoder
Decode a JWT token's header and payload online, free and instantly. Paste a token — with or without a Bearer prefix — and read its claims as formatted JSON. No signature verification. All processing is local.
How JWT decoding works
A JSON Web Token (JWT) is composed of three base64url parts joined by dots: header.payload.signature. The header describes the signing algorithm (for example HS256), and the payload holds the claims — the identity and attributes of the token (such as sub, name, iat, and exp).
This decoder reads those base64url segments, decodes them as UTF-8 JSON, and renders the header and payload as pretty-printed JSON so you can inspect a token quickly. The signature segment is surfaced as-is; it is never decoded to text and no verification is performed.
How to decode a JWT online
- Open the free JWT Decoder tool from DataFormatter.
- Paste the token — with or without a 'Bearer ' prefix.
- The header and payload appear as formatted JSON sections.
- Tokens embedded inside surrounding text are detected automatically.
Ways to use this decoder
- Debugging access tokens returned by authentication APIs
- Inspecting the claims of ID tokens during OAuth setup
- Understanding what information an application can read from a token
- Learning the structure of JWTs and JSON Web Algorithms
Frequently asked questions
What does a JWT decoder show?
A JWT is three base64url segments: header, payload, and signature. The decoder shows the decoded header (says the algorithm such as HS256) and payload (the claims, like sub, name, and exp) as readable JSON.
Does this decoder verify token signatures?
No. Like diagnostic JWT tools, it decodes the header and payload for inspection but does not verify the signature. Never trust the claims of an unverified token.
Is it safe to paste a JWT here?
Yes from a privacy standpoint — decoding happens locally in your browser and nothing is uploaded. Still avoid pasting live production tokens containing sensitive claims.