JWT Decoder

Splits a JSON Web Token at its two dots into header, payload, and signature, Base64URL-decodes the header and payload segments, and displays each as formatted, readable JSON.

Paste a full JWT string into the input box; the decoded header and payload appear automatically in two separate panels below it. The signature segment is shown as-is, since decoding it wouldn't produce meaningful text.

A token starting with `eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.signature` decodes to a header of `{"alg":"HS256"}` and a payload of `{"sub":"1234"}` — the `alg` field names the signing algorithm, and `sub` is a standard claim identifying the token's subject.

This reveals the token's claims — things like `exp` (expiration), `iat` (issued at), and any custom fields an application added — but it does not verify the signature, so it cannot tell you whether the token is authentic or has been tampered with; anyone can construct a JWT with an arbitrary payload without knowing the signing key.

Verifying a JWT's signature requires either the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256) that was used to sign it — since this tool never asks for or receives that key, it can only decode, never validate.

JWT payloads often contain user IDs, roles, or permissions that shouldn't be exposed, which is why decoding happens entirely in your browser rather than on a server you'd have to trust with the token.

Decoding runs entirely in your browser via client-side JavaScript; the token you paste is never uploaded to a server or stored.