Add the text, code or data.
01Developer toolFormatted output
JWT Decoder
Inspect the header and payload of a token.
100% FreeRuns instantlyNo watermark
- 1Paste inputAdd the text, code or data.
- 2AdjustChoose formatting or generation options.
- 3RunProcess everything in the browser.
Private by designProcessed on your device where possible.
Works on any deviceDesktop, tablet and mobile browsers.
No installationOpen the page and start working.
Always free coreUse the free plan for everyday tasks.
How to use JWT Decoder
Choose formatting or generation options.
02Process everything in the browser.
03Copy or download the clean result.
04Your files stay private
Your work is processed locally in your browser where possible and is never added to a Vootkit upload library.
Learn more about privacyA JSON Web Token looks like random text but is mostly not encrypted — the header and payload are Base64, readable by anyone holding the token. Which is exactly why you should know what your tokens are carrying.
What JWT Decoder does
Decodes a JWT’s header and payload into readable JSON.
Stated clearly: this decodes, it does not verify. Checking a signature needs the secret or public key, and without that you can read a token but cannot know whether it is genuine. Anyone can craft a token that decodes perfectly and is entirely fabricated.
Structure and limits
| Three parts | header.payload.signature, separated by dots |
|---|---|
| Header | The algorithm and token type |
| Payload | The claims — who, what, and until when |
| Signature | Not verified here — that needs the key |
| Encoding | Base64url, not encryption — readable by anyone |
| exp claim | Expiry, as a Unix timestamp |
| Common claims | sub (subject), iat (issued at), exp (expires), iss (issuer) |
Detailed steps
- Paste the token.
- Read the decoded header and payload.
- Check
expagainst the current time if you are debugging an authentication failure — an expired token is the most common cause.
Worth knowing
Never put anything secret in a JWT payload. It is Base64, not encrypted, and every client holding the token can read it — this page proves that in one paste. Email addresses and internal identifiers routinely end up in tokens that are then stored in browser local storage.
Frequently Asked Questions
Does this check whether the token is valid?
No. It decodes only. Verifying a signature requires the secret or public key the token was signed with, and without it a forged token decodes exactly as cleanly as a real one. Verification belongs on your server.
Is it safe to paste a token here?
The decoding happens in this page and nothing is transmitted. Even so, treat a live token like a password — it grants whatever access it was issued for. Use expired or test tokens where you can.
My token is rejected but decodes fine.
Decoding proves the structure is intact, not that the token is accepted. Check exp for expiry, iss and aud against what your service expects, and whether the signing key has rotated.
Why can anyone read the payload?
Because JWTs are signed, not encrypted. The signature proves the contents were not altered; it does not hide them. That trade-off is deliberate, and it is why payloads should carry claims rather than secrets.
Is JWT Decoder free?
Yes. The Vootkit free plan includes 5 tool runs a day. Upgrade to Vootkit Pro for unlimited daily use, an ad-free workspace and saved workflows.
Are my files uploaded?
No. JWT Decoder runs entirely in your browser — your file is processed on your own device and never sent to a server. There is nothing for us to store or delete.
Do I need to install anything?
No. JWT Decoder works in any modern browser on desktop, tablet or phone. Open the page and start.
How often can I use it? Is there a daily limit?
On the free plan you get 5 tool runs a day. When you reach the limit you'll see a prompt to upgrade, and it resets the next day. Vootkit Pro removes the cap entirely for unlimited daily use.
Recently viewed
This tool processes everything locally in your browser. You can disconnect from the internet after the page loads and it will still work.