JWT Payload Viewer - Decode Claims Online
View the decoded header and payload claims of a JSON Web Token instantly, formatted as readable JSON.
Related tools & use cases
How to use JWT Payload Viewer - Decode Claims Online
- 1Paste your JWT.
- 2View the header and payload as formatted JSON.
- 3Copy either section individually.
Privacy & security
Decoding happens locally — your token and its claims never leave the browser.
No data is uploaded.
Frequently asked questions
Can I see custom claims in the payload?
Yes — any custom claim the issuer included (roles, permissions, user metadata) appears in the decoded payload JSON alongside standard claims like sub, iat, and exp.
Viewing JWT Header and Payload Claims
A JWT's header and payload are Base64URL-encoded JSON, readable by anyone with the token — no secret required. This is useful for inspecting what data an auth system is actually issuing in its tokens.
Common use cases
Auditing What Data a Token Exposes
Check whether a token accidentally includes sensitive fields that shouldn't be readable client-side.
Tips for best results
- Never put secrets or sensitive personal data directly in a JWT payload — it's readable by anyone who has the token, not protected data.
More questions answered
What's typically in the header vs. the payload?
The header usually contains the signing algorithm (alg) and token type (typ). The payload contains the actual claims — subject, issuer, expiration, and any custom data.