JWT Decoder – Decode JWT Online (Free Tool)

JWT Decoder splits a JSON Web Token into its three parts — header, payload, signature — and base64url-decodes the first two so you can read the claims. It is the same view you get from jwt.io, but the token is decoded locally; nothing is uploaded. Use it when you need to confirm the algorithm, inspect the `exp` claim, or just see what your auth provider actually puts in the payload.

• No telemetry, no tracking pixels, no third-party scripts
• Open-and-go: bookmark the page once and never look for an alternative
• Instant results — no waiting on a server or upload progress bar
• Built for developer workflows: copy-friendly output, syntax-aware highlighting where useful
• Works with very large inputs (multi-megabyte JSON, long regex patterns, big tables)

1. Paste your input into the jwt decoder area
2. Configure the options if the defaults don't match your case
3. Click the action button and inspect the result
4. Copy the output to your clipboard or download as a file

• Debugging "401 Unauthorized" errors in API calls
• Verifying that an access token contains the expected scopes/roles
• Inspecting token expiry before retrying a failed request
• Comparing tokens issued by different identity providers
• Training and onboarding when explaining how JWTs work

"Invalid token" error.

Make sure you pasted exactly three base64url segments separated by dots. Stray quotation marks, leading "Bearer ", or whitespace break the parse.

Payload claims look garbled.

The token uses base64url (not standard base64). Our decoder handles that, but if you decoded by hand elsewhere, substitute "-" with "+" and "_" with "/" and add padding.

I can see the payload — is my token compromised?

Any holder of the token can read its payload; that is by design. Confidentiality comes from how you store and transmit the token, not from JWT itself.