JWT Decode
Decode JWT header and payload (no verify).
How to use JWT Decode
JWT Decode — Decode a JSON Web Token header and payload so you can read the claims. The signature is not verified. Free to use in D2i DevTools — no account required.
Steps
- Fill in JWT. This field is required.
- Click Run and copy the result under the form.
Frequently asked questions
What is JWT Decode used for?
Use it to inspect iss, exp, sub, and custom claims while debugging. Do not treat a decoded token as trusted.
How do I use the free online JWT Decode tool?
Fill in JWT. This field is required. Click Run and copy the result under the form.
What can I paste or upload into JWT Decode?
Paste a compact JWT: three Base64url parts separated by dots. The signature part can be present; it is not checked.
What output does JWT Decode give me?
The header JSON and the payload JSON, pretty-printed. exp and iat stay numeric Unix times.
Is JWT Decode free, and is my input private?
Yes — Your input is processed in memory for this request only. It is not saved to disk or the database, and it is cleared after the tool finishes.
Why can I decode a token that is expired or forged?
Decoding only reverses Base64url. Anyone can change the payload and leave a bad signature. Verify the signature and expiry in your API before you trust the claims.
Inputs are processed in memory only and are not saved to disk or the database. Data exists only for the duration of your request.