Decode a JWT online
Every JWT decodes the same way regardless of which tool does it: split on the two dots, base64url-decode the first two segments, parse each as JSON. Below is the mechanical walkthrough using a real (widely-published, non-sensitive) sample token, followed by a live decoder if you'd rather just paste your own.
The four steps, done by hand
1. Split on the dots
A JWT is always exactly three segments joined by .. Take this sample token — the same one RFC 7519 §3.1 uses as its own worked example:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Splitting on . gives three pieces: the header, the payload, and the signature.
2. Restore the base64url alphabet
Each of the first two segments uses base64url, not plain base64: replace every - with + and every _ with /, then pad the length out to a multiple of 4 with = if needed. The header segment eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 happens to need no substitution here — it contains none of the URL-safe replacement characters — but a real payload frequently does.
3. Base64-decode to bytes, then UTF-8-decode to text
Standard base64 decoding turns the restored string into raw bytes; those bytes are UTF-8 text, so decoding them gives a JSON string. Skipping the explicit UTF-8 step is the most common reason a hand-rolled decoder mangles accented letters or emoji in a claim value.
4. Parse the JSON
The decoded text for the header above is:
{
"alg": "HS256",
"typ": "JWT"
}
And the payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
The third segment, SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c, is the signature. There is nothing to "decode" about it in the same sense — it's the raw output of an HMAC or asymmetric signing operation, meaningful only when recomputed by whoever holds the matching key. Decoding stops here; verifying is a separate operation this walkthrough deliberately does not perform.
Paste a token above, or load the sample, to see it decoded. Nothing you type here is sent anywhere — the decoding happens in this page, in your browser.
Header algorithm & type
Payload claims
Signature not verified
Shown as-is. This tool decodes the header and payload but never checks the signature against a key, so it cannot tell you whether this token is authentic.
Recognised claims
None of this token's keys match a standard registered or common claim name.
| Claim | Where | Value | Meaning |
|---|
Why use an online decoder instead of doing this by hand every time
The steps above are mechanical but fiddly to get exactly right — base64url's alphabet substitution, optional padding, and a UTF-8 decode step that a quick script often skips. A decoder that runs the same four steps instantly, colour-codes the result, and checks exp/nbf against the current time saves the repetition without changing what's actually happening under the hood. The important property to check for, given what a real token usually contains, is whether that decoding happens in your browser or on someone else's server — see the security note on the main decoder page.
Frequently asked questions
Do I need to install anything to decode a JWT online?
No. Any of the online decoders, including this one, take a pasted token and give you back the decoded header and payload in your browser tab — no CLI, no library install, no account. The only thing worth checking before you use one is whether it actually keeps the decode client-side, since a production token can contain identifying data.
Can I decode a JWT with no internet connection?
Yes, in the sense that decoding needs no network call at all — it is base64 arithmetic and a JSON.parse. This specific page still has to load once over the network like any web page; after that, the decode itself would work with the connection pulled out, because it never contacts a server.
Why does the decoded payload look different from what I expected?
Two common causes: you copied a leading or trailing space or newline along with the token (strip whitespace before pasting), or you're looking at the wrong token — many auth flows issue an access token and an ID token together, and they carry different claims.