JWT Decoder
Decode JWT header and payload instantly
What is JWT Decoder?
JWT Decoder is a free developer utility from Farvixo that lets you decode JWT header and payload instantly. Your input is processed locally in the browser — nothing is sent to a server, which matters when the payload is a token, a config file or production data. Free, unlimited, no sign-up.
How to use JWT Decoder
Paste your snippet into JWT Decoder. It stays on your device, which matters when you are handling tokens, config or production data.
JWT Decoder processes the input instantly and points at the exact line when something is malformed, so you can fix it rather than hunt for it.
Copy the result to your clipboard or download it. Free, unlimited and no sign-up.
Frequently Asked Questions
Is it safe to paste a production token here?
Yes. Decoding happens entirely in your browser — there is no network request carrying the token and nothing is logged. This matters because a JWT frequently is the credential: pasting one into a site that sends it to a server hands over working access.
Does decoding a JWT verify it?
No, and the distinction is important. Decoding reads the header and payload, which are only Base64-encoded and readable by anyone. Verifying means checking the signature against a secret or public key, which proves the token was issued by who it claims and has not been altered.
Why can I read the payload without a key?
Because a JWT payload is encoded, not encrypted. The signature protects it from being modified, not from being read. Never put anything confidential in a JWT payload — assume everyone holding the token can see all of it.
What do the standard claims mean?
`exp` is expiry and `iat` is issued-at, both as Unix timestamps; `sub` identifies the subject, usually the user; `iss` is the issuer and `aud` the intended audience. An expired token or one with the wrong audience is rejected even though it decodes perfectly.
Which algorithms can it read?
It decodes any JWT regardless of algorithm — HS256, RS256, ES256 and the rest — because decoding does not involve the algorithm at all. Only signature verification does.
What you can use JWT Decoder for
- Inspecting or reformatting an API payload while debugging
- Decoding a token or encoded value without pasting it into an unknown website
- Generating test data or identifiers during development
- Validating a config file before it is committed or deployed
JWT Decoder at a glance
- Tool
- JWT Decoder — Developer Tools
- Purpose
- Decode JWT header and payload instantly
- Input
- Text or values you enter directly
- Output
- Processed output you can copy to the clipboard or download
- Processing
- In your browser — files are never uploaded to a server
- Price
- Free, unlimited, no account required
- Limitations
- Bounded by your device's memory and CPU rather than a server quota
Tips for better results
- Because processing is local, it is safe to paste real credentials or production payloads here — nothing is transmitted or logged.
- When parsing fails, the reported line and column point at the first invalid token, which is usually just after the real mistake.
- Bookmark the tool page directly; it loads without an account and works offline once cached.
Common problems and how to fix them
Parsing fails on valid-looking input
Usually a trailing comma, a smart quote pasted from a document, or an unescaped backslash. Check the reported position first.
Output has unexpected whitespace or line endings
The source used CRLF line endings or a non-breaking space. Normalise the input before processing.
Non-English characters come out wrong
The input was not UTF-8. Re-save the source as UTF-8 and paste it again.
More on Farvixo
More developer tools
JSON, Base64, JWT, UUID, hashing and API testing utilities.
Browse all developer tools →All in One Place
Smart & Intelligent
Lightning Speed
Your Data is Safe
Work Anywhere
API & Integrations