⌘K

JWT Encoder/Decoder

Encode and decode JSON Web Tokens.

Encoded Token

Valid JWT

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decode, inspect, and encode JSON Web Tokens in your browser to debug authentication issues and understand exactly what data is being passed between your client and server.

How to Decode a JWT

A JWT consists of three Base64Url-encoded parts separated by dots: the header, the payload, and the signature. Paste any token into the decoder and the tool will immediately decode the header and payload so you can inspect the claims.

Paste your token into the encoded token field on the Decode tab.
The header and payload are decoded and displayed automatically.
Click any section to copy it, or use the expand button for a larger view.
To create a new token, switch to the Encode tab and fill in the header, payload, and secret.

About JWT Authentication

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. It's a common method for handling authentication in modern web applications.

The Authentication Flow

The diagram below illustrates a typical JWT authentication flow using an external authorization server (like Auth0, Okta, or Firebase Auth).

User Login: The user initiates a login request from the client application.
Authentication: The client application redirects the user to an Authorization Server, which handles the actual authentication (e.g., username/password, social login).
Token Issuance: Upon successful authentication, the Authorization Server generates two tokens:
- An ID Token, which contains information about the user (their identity).
- An Access Token, which grants the application permission to access specific resources (APIs) on behalf of the user.
Application Access: The client application receives these tokens and stores them securely. It sends the Access Token in the `Authorization` header of API requests to the backend server, which validates the token to grant access.

Frequently Asked Questions

What is a JWT decoder?

A JWT decoder parses a JSON Web Token into its three components — header, payload, and signature — and displays the decoded data in a human-readable format.

How do I decode a JWT?

Paste the full JWT string (the three Base64Url-encoded parts separated by dots) into the input field, and the tool instantly decodes and displays the header and payload.

Can I also encode JWTs?

Yes. The tool includes an encoder tab where you can set the header and payload, optionally add a secret key, and generate a signed JWT token.

Does this tool verify JWT signatures?

The decoder shows the signature section but does not cryptographically verify it. To verify, you need the original signing key, which can be pasted into the verification field.

Is this decoder free?

Yes, ToolDock's JWT decoder is completely free, requires no signup, and runs entirely in your browser.

Base64 Encode/Decode

Encode and decode Base64 strings.

URL Encode/Decode

Encode and decode strings for URL-safe usage.

RSA Key Generator

Generate public and private RSA key pairs.

HMAC & Bcrypt Generator

Generate and verify HMAC signatures and bcrypt password hashes in your browser.

Encoded Token

Valid JWT

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decode, inspect, and encode JSON Web Tokens in your browser to debug authentication issues and understand exactly what data is being passed between your client and server.

How to Decode a JWT

Paste your token into the encoded token field on the Decode tab.
The header and payload are decoded and displayed automatically.
Click any section to copy it, or use the expand button for a larger view.
To create a new token, switch to the Encode tab and fill in the header, payload, and secret.

About JWT Authentication

The Authentication Flow

The diagram below illustrates a typical JWT authentication flow using an external authorization server (like Auth0, Okta, or Firebase Auth).

User Login: The user initiates a login request from the client application.
Authentication: The client application redirects the user to an Authorization Server, which handles the actual authentication (e.g., username/password, social login).
Token Issuance: Upon successful authentication, the Authorization Server generates two tokens:
- An ID Token, which contains information about the user (their identity).
- An Access Token, which grants the application permission to access specific resources (APIs) on behalf of the user.
Application Access: The client application receives these tokens and stores them securely. It sends the Access Token in the `Authorization` header of API requests to the backend server, which validates the token to grant access.

How to Decode a JWT

About JWT Authentication

The Authentication Flow

Frequently Asked Questions

What is a JWT decoder?

How do I decode a JWT?

Can I also encode JWTs?

Does this tool verify JWT signatures?

Is this decoder free?

Related Tools

How to Decode a JWT

About JWT Authentication

The Authentication Flow