About this jwt decoder
Paste a JSON Web Token to see its header and payload decoded into readable, indented JSON, without needing a backend or command-line tool. A JWT is three Base64URL-encoded sections separated by dots: a header describing the signing algorithm, a payload carrying the claims, and a signature. This tool decodes the first two sections so you can inspect claims like expiry and subject while debugging an authentication flow, and displays the signature as-is since verifying it correctly requires the issuer's secret or public key, which this tool never asks for or receives.
How it works
Each of the header and payload sections is Base64URL-decoded, padded as needed, and parsed as JSON, then re-serialized with two-space indentation. The signature section is shown unmodified and is explicitly labeled as not verified.
Try these examples
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature
HEADER {"alg":"HS256","typ":"JWT"} · PAYLOAD {"sub":"1234567890"}not.a.jwt
Error: the header is not valid Base64URL-encoded JSON
Limitations & privacy
This tool decodes only; it does not verify the signature, so a decoded payload should never be treated as authenticated without separately checking the signature against the issuer's key. Maximum input: 100,000 characters.
Inputs and results stay in this browser. Only tool identifiers are stored for your recently used tools. You can clear that history from the directory.
A few good questions
Does this verify that the token is genuine?
No. Verifying a JWT signature requires the issuer's secret or public key, which this tool never requests. It only decodes the readable header and payload.
Why does my token fail to decode?
A JWT needs exactly three dot-separated parts. Check that you copied the complete token, including all three sections, without extra whitespace.
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser using standard Base64 and JSON parsing; the token is never sent to a server.
Updated September 19, 2026