JWT Decoder
Decode JSON Web Tokens instantly. View the header and payload as readable JSON, just like jwt.io.
Free, no signup. This tool decodes only — it does not verify signatures.
Editing is a pain in the ass, right?
That's why we're building Cubix. No more editing hell.
AI Video Editor
Drop your footage, tell it what you want. Cubix cuts, captions, color grades, and exports — fully on its own. No timeline. No manual work. Just results.
Cinematic Screen Recorder
Hit record on Windows. Auto-zoom, cinematic backgrounds, and studio-quality audio kick in automatically — your screen recording looks edited before you've touched a thing.
How to Decode a JWT Online
Turn an opaque token string into readable header and payload JSON in three steps.
Paste Your JWT
Drop in a full JSON Web Token in the standard header.payload.signature format.
Decode
Click Decode JWT to base64url-decode the header and payload into readable JSON.
Copy or Download
Copy the decoded header, payload, and signature, or download them as a text file.
// token
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.sig
// decoded payload
{"sub":"1234"}
Header & Payload
Both parts are decoded and pretty-printed side by side, along with the raw signature.
Decode Only
No signature verification is performed — this is purely a decoding and inspection tool.
Instant Results
Decoding happens instantly. Copy to clipboard or download as a text file.
Level up your editing workflow.
Get weekly insights on video editing, AI workflows, and creator growth straight to your inbox.
Frequently Asked Questions
What does the JWT Decoder do?
It splits a JSON Web Token into its three parts, base64url-decodes the header and payload, and shows them as readable JSON — just like the decoded panel on jwt.io.
Does this tool verify the JWT signature?
No. It only decodes the header and payload for inspection. It does not verify the signature against a secret or public key, so never trust a decoded token as proof of authenticity.
Is my token sent anywhere or stored?
The token is decoded on request only to split and parse its contents, and nothing is stored afterward.
What if my token is invalid?
If the token doesn't have exactly three dot-separated parts, or the header/payload isn't valid base64url JSON, the tool shows a clear error explaining what's wrong.
How do I decode a JWT without the secret key?
You don't need one. A JWT's header and payload are base64url-encoded, not encrypted, so anyone holding the token can read them. Paste the token here and both parts appear as JSON. The secret is only needed to verify the signature, which this tool does not do.
Is a JWT encrypted or just encoded?
Just encoded. Base64url is reversible by design, so never put passwords, card numbers, or other secrets in a JWT payload — assume anyone who gets the token can read every claim inside it.
How do I check when my JWT expires?
Decode the token and look for the exp claim in the payload. It's a Unix timestamp in seconds. Paste that number into our Unix Timestamp Converter to see the exact date and time, and compare it to now to find out whether an expired token is why your API is returning 401.
Which algorithm is my token signed with?
The alg field in the decoded header tells you — commonly HS256 for shared-secret signing or RS256 for public/private key signing. The kid field, when present, names which key was used.
Does this work with Auth0, Firebase, Cognito, Supabase, or Okta tokens?
Yes. Any standard JSON Web Token works, whichever provider issued it. Access tokens, ID tokens, and refresh tokens in JWT format all decode the same way.
Is this a free jwt.io alternative?
Yes. The JWT Decoder is completely free with no signup, no login, and no limits. It covers the decoded header and payload view that most people open jwt.io for.
Related developer tools
Decode Base64, format JSON, and inspect encoded data in one place.