What Is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way of representing claims (like "this user is logged in as Alice") that can be verified and trusted because it's digitally signed. JWTs are everywhere in modern authentication — APIs, single sign-on, session tokens.
A JWT looks like three Base64URL-encoded segments separated by dots — a header, a payload, and a signature.
What's Inside Each Part
How to Decode a JWT for Free
Why This Matters for Debugging
When an API call fails with "unauthorized" or "token expired," decoding the JWT lets you immediately check: Is the expiration claim in the past? Does the subject/user ID match what you expect? Is the algorithm what your server expects?
Frequently Asked Questions
Does this tool verify the token's signature?
No — it decodes and displays the header and payload for inspection. Verifying a signature requires the secret key or public certificate, which should never be entered into a third-party tool.
Is it safe to paste my JWT here?
Decoding happens entirely in your browser — the token is never transmitted to a server. That said, treat tokens like passwords and avoid pasting production tokens with sensitive claims into any tool unnecessarily.
Why do I get a decode error?
Make sure you've pasted the complete token, including all three dot-separated segments, with no extra whitespace or line breaks.
Related Tools
JWTs are Base64URL-encoded — learn more with the Base64 Encoder/Decoder, or generate test tokens and IDs with the UUID & Hash Generator.