JWT Decoder

Overview

• Decomposes a JWT (JSON Web Token) into its Header, Payload, and Signature parts so you can inspect the contents of each.

• A JWT is only Base64URL-encoded, not encrypted, so anyone can decode and read its contents.

• This tool does not verify the signature, so it is focused purely on inspecting contents. Confirming the token has not been tampered with requires separate signature verification.

Usage

1. 1

   Enter a JWT (in xxxxx.yyyyy.zzzzz format) into the text area.

2. 2

   Click the "Decode" button.

3. 3

   The decomposed Header, Payload, and Signature are displayed.

Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header:
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Use Cases

• Quickly checking the contents of a JWT's Payload (claims) while implementing or debugging authentication

• Visually checking a JWT's expiration (exp) or issuer (iss) that was shared by a user during support

• Checking the signing algorithm (alg) used by looking at the Header of a JWT received from another system

FAQ

Notes

• This tool does not verify the signature. Contents looking correct is not a guarantee that the token has not been tampered with.

• When decoding a production JWT, especially one containing personal user information, be careful that the screen contents are not seen by others.

• Only the Header and Payload are decoded and displayed; the Signature part is shown as-is without decoding.