52
ENKO

JWT Decoder

Decode JWT header and payload instantly. No verification, no server upload. Works in your browser.

Next step
Decode a Base64 string.Base64 Encode/DecodeFormat the decoded payload.JSON Formatter

JWTs often look like opaque strings, but troubleshooting authentication usually means checking header and payload claims quickly. This tool helps you inspect exp, iat, nbf, scopes, and user - related values without sending the token to a server.

Developer ToolsBrowser-basedOpen full guide

Related Tools

URL Encode/DecodeEncode or decode URLs and query strings instantly. Handle special characters safely in URLs.JSON YAML ConverterConvert JSON to YAML or YAML to JSON instantly. Runs in your browser with no upload.Date CalculatorCalculate D - Day, days between two dates, workdays (exclude weekends), and contract periods instantly. Runs in your browser (no uploads).UUID GeneratorGenerate random UUIDs (v4) and GUIDs instantly. Create unique identifiers for databases, APIs, and applications.

Related Articles

JSON API Debugging Checklist: Fast Root Cause IsolationUse this API debugging checklist to quickly isolate malformed JSON, encoding issues, and schema mismatches before they hit production.What is Base64 Encoding? A Practical GuideUnderstand Base64 encoding: what it is, why it's used, and how to encode/decode values for APIs, emails, and data URIs.

Help and details

How to use

  1. Paste the full JWT token into the input area.
  2. Review the decoded header and payload JSON.
  3. Inspect standard claims such as exp, iat, and nbf.
  4. Copy the decoded JSON or claim summary if needed.

Privacy and processing

Decoding happens locally in your browser. Your token is never sent to our servers.

Frequently Asked Questions

Does this verify JWT signatures?
No. This tool only decodes header and payload data. Signature verification requires the correct secret or public key.
Is my token uploaded to a server?
No. Decoding runs entirely in your browser.
Why is my JWT invalid?
A JWT must contain three dot - separated parts, and the header and payload must decode into valid JSON.
What are exp, iat, and nbf?
They are standard JWT claims. exp is expiration time, iat is issued - at time, and nbf is not - before time.
Can I decode encrypted JWTs?
No. Encrypted JWTs require decryption keys and are not readable through simple decoding.
Why do I see strange characters?
The token may not contain UTF - 8 JSON, or it may not actually be a JWT payload.