How to Decode JWT and Base64 Strings Securely
JSON Web Tokens (JWT) are widely used for modern web authentication, authorization, and information exchange. Whether you are debugging a failed login, verifying user roles, or checking token expiration dates, our Free JWT Decoder provides instant, secure visibility into your encoded tokens.
Absolute Privacy
Security is paramount when dealing with authentication tokens. This tool runs 100% locally in your browser. Your tokens, API keys, and Base64 strings are NEVER transmitted to a backend server. We do not store, log, or track the data you paste here.
Auto-Detection
No need to select a mode. Simply paste your string. The tool automatically detects if the string is a 3-part JWT (Header, Payload, Signature) or a standard Base64 string, and decodes it instantly with formatted JSON syntax highlighting.
Understanding the Structure of a JWT
A JSON Web Token consists of three parts separated by dots (.):
- Header (Red): Contains metadata about the token, typically the type of token (JWT) and the signing algorithm used (e.g., HMAC SHA256 or RSA).
- Payload (Purple): Contains the claims or statements about an entity (typically, the user) and additional data. This is where you'll find the
sub(subject),iat(issued at), andexp(expiration time) fields. Note: The payload is encoded, not encrypted, meaning anyone can read it! Never store sensitive data like passwords here. - Signature (Blue): Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way. It is generated using the encoded header, encoded payload, a secret, and the algorithm specified in the header.
Base64 vs Base64Url
JWTs specifically use Base64Url encoding, which is slightly different from standard Base64. Base64Url omits the +, /, and = characters so the token can be safely passed in HTTP headers and URLs. Our decoder automatically normalizes Base64Url strings to standard Base64 before decoding, ensuring flawless extraction every time.
Can I edit and re-encode a JWT here?
Currently, this tool is designed for decoding and debugging. While you can easily decode the payload to inspect user data, modifying the payload and re-encoding it without the original secret key will invalidate the token's signature. The server will reject the modified token.