How to Use JWT Decoder: Complete Guide (2026)

What is JWT Decoder?

A JWT decoder splits a JSON Web Token into its three Base64URL parts so you can read the header, payload claims, and signature. ToolsMinify's free JWT Decoder pretty-prints the JSON in your browser and never verifies the signature - useful for debugging tokens, not for trusting them. Nothing you paste is uploaded.

Decode JWT header, payload, and signature in your browser. Free JSON Web Token decoder - no signature verification, nothing uploaded.

Why use JWT Decoder?

• Inspect header, payload, and signature in one view
• Pretty-printed JSON with a copy button per section
• Strips an optional Bearer prefix automatically
• Clear errors for bad structure, Base64URL, or JSON
• Decode-only and fully client-side - the token stays on your device

How to use JWT Decoder - step by step

1. Step 1: Paste a JWT into the input. A Bearer prefix is optional and is stripped automatically.
2. Step 2: The header and payload appear as pretty-printed JSON. The signature is the raw third segment.
3. Step 3: Copy any section with one click.
4. Step 4: If the token is malformed, a short error explains whether the structure, encoding, or JSON is wrong.

The JWT Decoder lives under Developer Tools. Open the tool page, enter your input in the main field, and results update instantly. Use the copy button to paste output into documents, code editors, or spreadsheets.

Common use cases

Debugging API bearer tokens

Paste a token from an Authorization header to see alg, typ, sub, exp, and other claims without sending it to a third-party debugger.

Checking expiry and issued-at claims

Read iat and exp in the payload when a request is rejected as unauthorized, then confirm the real verification still happens on your server.

Learning JWT structure

See how header.payload.signature maps to JSON objects and a Base64URL signature, including unsecured tokens with an empty third segment.

Comparing tokens during development

Decode two tokens side by side in separate tabs to compare claims after a login or refresh-token flow.

Examples

• Standard three-part JWT: header.payload.signature decodes to a JSON header (alg, typ), a JSON payload (claims such as sub, iat, exp), and a Base64URL signature.
• Authorization header: Paste Bearer eyJ... - the tool strips the Bearer prefix and decodes the token.
• Unsecured JWT (alg none): A token with an empty third segment still decodes. The signature field is blank - this tool still does not verify anything.

Pro tips

• This tool never verifies signatures. Anyone can forge header and payload claims.
• Do not paste production secrets or live session tokens into any online decoder you do not control - this one stays in the browser, but habit still matters.
• A valid JWT has exactly three parts. A missing trailing dot on an unsecured token will fail.
• exp and iat are Unix timestamps in seconds; convert them with a timestamp tool if you need a human date.
• Pair with Hash Generator or Base64 Encoder / Decoder when you are learning encoding, not as a substitute for server-side verification.

Frequently asked questions

What is a JWT?

A JSON Web Token is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. APIs use JWTs as bearer tokens. This tool only decodes the parts so you can read them.

Does this decoder verify the signature?

No. Verification needs the secret or public key and must happen on a trusted server. Decoding only shows what the token claims, which anyone can forge.

Is my token sent to a server?

No. Decoding runs entirely in your browser. Nothing you paste is uploaded, logged, or stored.

Why do I see an error?

A valid JWT has exactly three parts. The header and payload must be Base64URL-encoded JSON. Extra dots, missing parts, or corrupted encoding produce a friendly error.

Can I trust exp, sub, or role claims from this tool?

Not by themselves. Anyone can create a token with any claims. Use this view to debug tokens you already have, then verify signatures in your backend.

What is Base64URL?

Base64URL is Base64 with + and / replaced by - and _, and padding often omitted. JWT header and payload use this encoding so tokens are URL-safe.

How do I convert JWT exp/iat Unix timestamps into a date?

In a JWT payload, `iat` is the “issued at” Unix time and `exp` is the “expires at” Unix time. Copy those numbers and paste them into the Unix Timestamp Converter: https://www.toolsminify.com/converter-tools/timestamp-converter. That tool converts the Unix seconds or milliseconds into a readable UTC and local date/time.

Related tools you might need

Explore other developer tools on ToolsMinify. Related utilities are linked on the JWT Decoder page to help you complete your workflow without leaving the site.