JWT Decoder
Paste a JWT (JSON Web Token) and instantly see its decoded header, payload, and raw signature — entirely in your browser.
🔒 Processed locally in your browser
Loading…
How to use
- Paste a full JWT — three base64url segments separated by dots — into the box above.
- The header and payload are decoded and pretty-printed live underneath as soon as you paste, with no button to press.
- The raw signature segment is shown as-is for reference; it is never checked or verified.
- Use the Copy buttons next to each panel to copy the header, payload, or signature individually.
Features
- Instantly decodes both the header and payload as formatted, readable JSON
- Handles base64url encoding correctly, including missing padding
- Displays the raw signature segment for reference, without attempting to verify it
- Clear inline error messages for malformed tokens instead of a crash or blank screen
- 100% client-side — your token never leaves your browser
Frequently asked questions
Does this tool verify the JWT's signature?
No. This tool only decodes the header and payload so you can read them — it never verifies the signature. Verifying a signature requires the secret (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms), and this tool never asks you to paste either one. A token decoding successfully only means it's well-formed, not that it's authentic or hasn't been tampered with.
Is my token uploaded anywhere?
No. Everything happens locally in your browser using JavaScript's built-in base64 and JSON APIs. Your token is never sent to a server, which matters since JWTs often contain sensitive claims.
Why does decoding fail with a 'not valid JSON' error?
This happens when a segment isn't a standard JWT — for example, if the token was truncated, edited by hand, or isn't actually a JWT at all. Encrypted tokens (JWE) also won't decode this way, since their payload is ciphertext, not JSON.
What's the difference between base64 and base64url?
JWTs use base64url encoding, a URL-safe variant of base64 that replaces '+' with '-' and '/' with '_', and typically omits the trailing '=' padding. This tool converts base64url back to standard base64 before decoding, so it works correctly even when padding is missing.
Can I decode an expired or already-used token?
Yes. Decoding just reads the claims that are already inside the token — it works the same whether the token is expired, revoked, or still valid, since none of that is checked here.