JWT Decoder

Overview

• Decomposes a JWT (JSON Web Token) into its Header, Payload, and Signature parts so you can inspect the contents of each.
• A JWT is only Base64URL-encoded, not encrypted, so anyone can decode and read its contents.
• This tool does not verify the signature, so it is focused purely on inspecting contents. Confirming the token has not been tampered with requires separate signature verification.

Usage

1. Enter a JWT (in xxxxx.yyyyy.zzzzz format) into the text area.
2. Click the "Decode" button.
3. The decomposed Header, Payload, and Signature are displayed.

Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header:
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Use Cases

• Quickly checking the contents of a JWT's Payload (claims) while implementing or debugging authentication
• Visually checking a JWT's expiration (exp) or issuer (iss) that was shared by a user during support
• Checking the signing algorithm (alg) used by looking at the Header of a JWT received from another system

FAQ

Notes

• This tool does not verify the signature. Contents looking correct is not a guarantee that the token has not been tampered with.
• When decoding a production JWT, especially one containing personal user information, be careful that the screen contents are not seen by others.
• Only the Header and Payload are decoded and displayed; the Signature part is shown as-is without decoding.