How to Use JWT Decoder: Complete Guide (2026)

What is JWT Decoder?

A JWT decoder splits a JSON Web Token into its three Base64URL parts so you can read the header, payload claims, and signature. ToolsMinify's free JWT Decoder pretty-prints the JSON in your browser and never verifies the signature on Decode. The Encode tab on the same page signs compact HS256 test tokens with Web Crypto - the secret never leaves the device. Nothing you paste is uploaded.

Decode JWT header, payload, and signature in your browser. Encode HS256 test tokens on the same page. Free JSON Web Token decoder - nothing uploaded.

Why use JWT Decoder?

• Inspect header, payload, and signature in one view
• Pretty-printed JSON with a copy button per section
• Strips an optional Bearer prefix automatically
• Clear errors for bad structure, Base64URL, or JSON
• Encode tab signs HS256 tokens in the browser - no new URL
• NumericDate chips for iat/exp plus a 32-byte secret check
• Decode-only verification stance and fully client-side - the token stays on your device

How to use JWT Decoder - step by step

1. Step 1: Decode is the default tab. Paste a JWT. A Bearer prefix is optional and is stripped automatically.
2. Step 2: The header and payload appear as pretty-printed JSON. Time claims (iat, exp, nbf) show Unix seconds plus UTC and local clocks. The signature is the raw third segment.
3. Step 3: Switch to Encode to sign a test token. Header JSON is pre-filled with alg HS256. Edit the payload, optionally tap a NumericDate chip for iat or exp, then enter a secret and sign.
4. Step 4: Copy the token, or send it to the Decode tab to inspect the compact JSON that was actually signed. If input is malformed, a short error explains whether the structure, encoding, or JSON is wrong.

The JWT Decoder lives under Developer Tools. Open the tool page, enter your input in the main field, and results update instantly. Use the copy button to paste output into documents, code editors, or spreadsheets.

Common use cases

Debugging API bearer tokens

Paste a token from an Authorization header to see alg, typ, sub, exp, and other claims without sending it to a third-party debugger.

Checking expiry and issued-at claims

Read iat and exp in the payload when a request is rejected as unauthorized, then confirm the real verification still happens on your server.

Learning JWT structure

See how header.payload.signature maps to JSON objects and a Base64URL signature, including unsecured tokens with an empty third segment.

Minting HS256 test tokens

Use the Encode tab to sign compact HS256 JWTs for Postman or local APIs. NumericDate chips set iat and exp without looking up Unix time, and Inspect on Decode confirms the compact JSON that was signed.

Examples

• Standard three-part JWT: header.payload.signature decodes to a JSON header (alg, typ), a JSON payload (claims such as sub, iat, exp), and a Base64URL signature.
• Authorization header: Paste Bearer eyJ... - the tool strips the Bearer prefix and decodes the token.
• Unsecured JWT (alg none): A token with an empty third segment still decodes. The signature field is blank - Decode still does not verify anything.
• HS256 test token: On Encode, keep the HS256 header, set payload claims, enter a dev-only secret, and sign. The output is a compact three-part JWT you can paste into Postman or send to Decode.

Pro tips

• The Decode tab never verifies signatures. Anyone can forge header and payload claims.
• Do not paste production secrets or live session tokens into any online decoder you do not control - this one stays in the browser, but habit still matters.
• A valid JWT has exactly three parts. A missing trailing dot on an unsecured token will fail.
• exp and iat are Unix timestamps in seconds; this page shows UTC and local clocks, and the Unix Timestamp Converter is one click away.
• Encode pins alg to HS256 and compact-serializes JSON. Pretty-print spaces in jwt.io change the signature - this encoder matches jsonwebtoken-style compact output.
• HS256 secrets should be at least 32 UTF-8 bytes. Pair with Hash Generator when you are learning HMAC, not as a substitute for server-side verification.

Frequently asked questions

What is a JWT?

A JSON Web Token is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. APIs use JWTs as bearer tokens. Decode reads the parts. Encode builds an HS256-signed token for tests.

Does this decoder verify the signature?

No. The Decode tab never verifies. Verification needs the secret or public key and must happen on a trusted server. Decoding only shows what the token claims, which anyone can forge.

Can I encode or sign a JWT here?

Yes, on the Encode tab of this same page - there is no separate jwt-encoder URL. It signs compact JSON with HMAC-SHA256 (HS256) in your browser. Use a disposable test secret, never a production key.

Why only HS256 and not RS256?

HS256 is HMAC with a shared secret and runs in the Web Crypto API without uploading a private key. RSA and ECDSA need key pairs and belong on a server. This page pins alg to HS256 so the header cannot say RS256 while the bytes are HMAC. For the raw HMAC hex digest of a message plus secret, use HMAC mode on Hash Generator.

Is my token or secret sent to a server?

No. Decode and Encode run entirely in your browser. Nothing you paste is uploaded, logged, or stored.

Why do I see an error?

A valid JWT has exactly three parts. The header and payload must be Base64URL-encoded JSON. Extra dots, missing parts, or corrupted encoding produce a friendly error. Encode also rejects invalid header or payload JSON and an empty secret.

Can I trust exp, sub, or role claims from this tool?

Not by themselves. Anyone can create a token with any claims. Use Decode to debug tokens you already have, then verify signatures in your backend.

What is Base64URL?

Base64URL is Base64 with + and / replaced by - and _, and padding often omitted. JWT header and payload use this encoding so tokens are URL-safe.

How do I convert JWT exp/iat Unix timestamps into a date?

In a JWT payload, iat is issued-at Unix time and exp is expires-at Unix time. This page already shows UTC and local clocks for those claims. You can also copy the numbers into the Unix Timestamp Converter: https://www.toolsminify.com/converter-tools/timestamp-converter.

Related tools you might need

Explore other developer tools on ToolsMinify. Related utilities are linked on the JWT Decoder page to help you complete your workflow without leaving the site.