ToolPuma Logo

JWT Decoder

Decode the header and payload of a JWT token.

What Is a JWT Decoder?

The JWT Decoder decodes the three parts of a JSON Web Token (JWT): the header, the payload, and the signature. It is an essential tool for developers to inspect the claims inside an access token. Note that decoding does not verify the cryptographic signature.

How to Use This JWT Decoder

  1. 1
    Paste the tokenPaste your JWT into the input field.
  2. 2
    Read the headerSee the signing algorithm and token type.
  3. 3
    Read the payloadInspect the claims such as sub, exp, and iat.
  4. 4
    Use the signatureThe raw base64url signature is shown for reference.

Frequently Asked Questions

No. This tool only decodes the base64url JSON payload. Verifying that the signature is valid requires the issuer's secret or public key, which this tool does not do.
A JWT has a header with the algorithm, a payload of claims (such as the subject, issuer, expiration), and a signature. The payload is only base64 encoded, not encrypted.
No. Decoding happens entirely in your browser. However, exercise caution: a JWT you can decode may contain sensitive claims, so pasting it into any untrusted site is risky.

Related Security & Privacy Tools

Password Generator

Generate strong random passwords with full control.

Random Password Generator

Create secure random passwords instantly.

Password Strength Checker

Evaluate how strong a password really is.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 and SHA-3 hashes.

JWT Inspector

Decode a JWT and check exp, nbf and algorithm claims.

SSL Certificate Checker

Read and analyze the TLS certificate a server presents.

More Security & Privacy Tools

SSL Expiry Checker

See how many days remain until a certificate expires.

Security Headers Checker

Verify the presence of essential security headers.

HTTP Headers Analyzer

Fetch and inspect every response header of a URL.

CSP Checker

Review a Content Security Policy for risky directives.

CORS Checker

Analyze CORS headers for misconfigurations.

Cookie Analyzer

Check cookies for Secure, HttpOnly and SameSite flags.