JWT Decoder

Read the JSON header and payload of a three-part JWT. Inspect claims without mistaking decoding for signature verification or token authorization.

Inspect the readable parts of a JSON Web Token while debugging an application. The tool Base64url-decodes the header and payload into JSON panels. It does not verify the signature, enforce expiry, contact an issuer or establish that any claim should be trusted.

100% free
No registration
On your device
Modern browser

1Enter details
2Adjust options
3View result

JWT Token Input

Header (Algorithm)Live

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload (Claims)Live

{
  "sub": "1234567890",
  "name": "Antigravity User",
  "iat": 1516239022
}

Your input stays on this device for this operation. We don’t upload or store it.

About JWT Decoder

Base64url parsing

Normalizes URL-safe characters for decoding the token's JSON parts.

Separate header and claims

Displays the two decoded JSON objects in distinct panels.

Copy each JSON part

Copy header or payload JSON for a redacted debugging fixture.

How to use JWT Decoder

1
Use a redacted test token
Paste a JWT with three dot-separated parts. Avoid exposing a live access token in a shared session or screenshot.
2
Inspect both JSON panels
Read the header's algorithm field and the payload claims separately.
3
Verify in the application
Use the issuer's keys and your application's validation rules to verify signatures, audience, issuer and time-based claims.

Formats and practical limits

Input: a three-part compact JWT. Output: decoded header and payload JSON, or a parse error.

No signature verification, issuer lookup, decryption or automatic expiry decision.
Token claims can contain sensitive information even when the token is signed rather than encrypted.

Practical example

Treat an alg value of HS256 or an exp timestamp as information to inspect, not as proof that the token has passed authentication.

Frequently Asked Questions

3 answers

Does this prove the JWT is genuine?

No. Anyone can construct header and payload text. A correct verifier must validate the signature and application-specific claims.

Can it decrypt an encrypted JWT?

No. This implementation expects three parts and parses the first two as JSON; it does not decrypt a five-part compact encrypted token.

Does showing an exp claim mean the token is valid?

No. The tool displays data without evaluating whether the token is expired, intended for your application or authorized.

About JWT Decoder

Base64url parsing

Separate header and claims

Copy each JSON part

How to use JWT Decoder

Use a redacted test token

Inspect both JSON panels

Verify in the application

Formats and practical limits

Practical example

Frequently Asked Questions

Related tools

Base64 Decoder

JSON Formatter

Timestamp Converter

Base32 Decoder