What this site is
jwtdecoded.com is a free online tool for decoding and inspecting JSON Web Tokens (JWTs), paired with a growing library of practical guides on how JWTs work and how to use them safely. Paste a token into the decoder and you can immediately see its header, payload, and signature — every claim parsed, formatted, and explained.
The decoder is the front door, but the goal of the site is broader: to be a clear, accurate, and genuinely useful reference for developers working with token-based authentication. Whether you are debugging an expired token at 2am, choosing a signing algorithm for a new API, or learning how OAuth 2.0 and OpenID Connect relate to JWTs, the aim is that you leave with the answer and a little more understanding than you arrived with.
Who builds it
jwtdecoded.com is built and maintained by an independent software developer with hands-on experience building authentication and API systems in production. It is not run by a large company or a marketing team — it is a focused tool made by a developer who got tired of pasting tokens into bloated, ad-choked decoders and wanted something fast, clean, and trustworthy.
Every guide on the site is written from practical experience, cross-checked against the relevant specifications — primarily RFC 7519 (JSON Web Token), RFC 7515 (JSON Web Signature), and RFC 7516 (JSON Web Encryption) — rather than paraphrased from other blog posts.
Our privacy stance
This is the principle the whole site is built around: your tokens never leave your browser.All decoding happens locally in JavaScript on your device. When you paste a JWT, there is no network request, no upload, and no logging of the token contents. We could not read your tokens even if we wanted to — the code that would be required to send them simply isn't there.
That matters because JWTs frequently contain real session data, user identifiers, and access scopes. Pasting one into a tool that round-trips it through a server is a quiet but real security risk. Doing the work client-side removes that risk entirely. You can read exactly what we collect — and what we don't — on the privacy policy page.
Editorial principles
- Accuracy over volume. Guides are checked against the source specifications and updated when our understanding improves or the standards evolve.
- Practical first. Every guide is written to answer a question a working developer actually has, with real code examples in multiple languages where it helps.
- No dark patterns. The decoder will never ask you to sign up, log in, or hand over a token to "unlock" a feature. The tool is the product.
- Corrections welcome. If something on the site is wrong or out of date, we want to know. Use the contact page and we'll fix it.
How the site is funded
Running a free tool still costs time and money — hosting, domains, and the hours that go into writing and maintaining the guides. To keep the decoder free and open to everyone, the site is supported by unobtrusive display advertising. Ads are kept out of the way of the tool itself, and they never have access to the tokens you decode — that processing stays entirely in your browser, separate from any third-party script.
We use anonymous, privacy-respecting analytics to understand which guides are useful and where the tool can be improved. We do not sell data, and we do not build personal profiles. Full detail is in the privacy policy.
Get in touch
Found a bug, want to suggest a guide, or spotted something that needs correcting? The contact page goes straight to the maintainer. Feedback from developers using the tool day-to-day is the single biggest driver of what gets built and written next.