English

JWT Decoder

Decode JWT headers and payloads directly in your browser.

Decoder only. Decoding a JWT does not verify its signature or prove that the token is valid or trustworthy.

More tools you might find useful.

Base64 Encoder & Decoder Encode or decode Base64 text locally.
JSON Formatter Format, validate and minify JSON data.
JSON ↔ YAML Converter Convert JSON to readable YAML or YAML to formatted JSON locally, with safe parsing and clear errors.
URL Encoder & Decoder Encode or decode URL-safe text.
CSV ↔ JSON Converter Convert CSV with headers to JSON or flat JSON objects to properly escaped CSV.
HTML Entity Encoder & Decoder Encode HTML special characters or decode named and numeric entities into plain text.
Text to Slug Turn a heading or phrase into a lowercase, hyphen-separated URL slug with sensible Unicode handling.
UUID Generator Generate random UUID v4 identifiers instantly.
Unix Timestamp Converter Convert Unix timestamps and readable dates.
Color Converter Convert HEX, RGB and HSL colors with normalized values and a local preview.

Decode JWT Tokens Online

Paste a JSON Web Token to inspect its decoded header and payload. HandyKitz formats the decoded JSON so claims and token metadata are easier to read.

What is a JWT?

A JSON Web Token, or JWT, is commonly represented as three Base64URL-encoded parts separated by dots: a header, a payload and a signature.

What does JWT decoding show?

Decoding reveals the JSON stored in the JWT header and payload, including claims such as expiration time, issue time, subject and issuer when they are present.

Does decoding verify a JWT?

No. Decoding a JWT does not verify its signature, authenticity or trustworthiness. A token can be decoded even when its contents have been modified or its signature is invalid.

Private browser-based decoding

JWT decoding happens locally in your browser. The token you enter does not need to be uploaded to the HandyKitz server.

Practical example

Inspect claims for debugging, but use signature verification in your application to establish authenticity. An expiration claim is a Unix timestamp in seconds.

A payload containing {"sub":"123","exp":1704067200} has subject 123 and an expiry of 2024-01-01 at 00:00 UTC. Displaying it does not prove the token is genuine.

Frequently asked questions

Why is a five-part token rejected?

The decoder expects the three-part JWT form. A five-part encrypted JWE needs decryption and cannot be inspected by this tool.

Why is there no expiration date in the output?

The payload may have no exp claim, or it may not contain a usable numeric timestamp. The tool does not invent missing claims.

Can I paste an Authorization header directly?

Paste only the token, without the Bearer prefix or surrounding header text. Those extra characters are not part of the encoded JWT.