JWT Decoder Online — Decode JSON Web Tokens Safely

What is JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) for securely exchanging information between parties as a JSON object. A JWT consists of 3 parts separated by dots:

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc123

• Header — signing algorithm (HS256, RS256…) and token type
• Payload — data (claims): sub, name, exp, iat…
• Signature — digital signature to verify integrity

Metoolzy’s JWT Decoder

JWT Decoder helps you decode a JWT token to view its header and payload content — it does not verify the signature.

Features

• Decode header + payload — Displays JSON formatted and syntax highlighted
• Expiration check — Green/red badge for exp (expired?), shows iat as date and time
• Copy individual parts — Copy header, payload, or signature separately
• Security warning — Reminds you not to paste production tokens with sensitive data
• 100% Client-side — Tokens are not sent to a server, decoding happens entirely in the browser

How to use

1. Visit JWT Decoder
2. Paste the JWT token (starting with eyJ...) into the textarea
3. The Header and Payload will automatically appear below
4. Check the exp badge — it turns red if the token is expired

Common JWT Claims

Claim	Meaning	Example
sub	Subject (user ID)	“1234567890”
name	User’s name	“John Doe”
iat	Issued At (creation time)	1716000000
exp	Expiration (expiration time)	1716086400
iss	Issuer (issuing party)	“auth.example.com”
aud	Audience (intended recipient)	“my-app”

Frequently Asked Questions

Is it safe to paste a JWT into an online tool?

Metoolzy’s JWT Decoder runs 100% client-side — the token is not sent anywhere. However, avoid pasting production tokens containing real user data into any online tool.

Why doesn’t it verify the signature?

Verifying a signature requires a secret key or public key — which shouldn’t be shared on an online tool. Decoding the payload is sufficient for debugging purposes.

Is JWT decoding the same across all tools?

Yes. The JWT header and payload are just Base64URL encoded — any decoder will produce the same result.

👉 Decode JWT for free →

See more: Base64 Encode/Decode · Hash Generator · JSON Formatter