JWT Decoder
Decode a JWT's header and payload — this tool never verifies the signature.
This only decodes the token — it does not verify it.
The output below is unencrypted data read directly out of the token, not a confirmation that the token is genuine or untampered. Verifying a signature requires the signing secret or key, which this tool never asks for, accepts, or has any access to.
Decoded header and payload will appear here.
What This Tool Does
This tool reads a JWT (JSON Web Token) and displays its header and payload as formatted, readable JSON. A JWT's header and payload are Base64URL-encoded, not encrypted — this tool reverses that encoding so you can inspect what's actually inside a token, for debugging or learning purposes.
How to Use It
Paste a JWT into the input box and click Decode. The header and payload appear below as formatted JSON. This tool never asks for a signing secret or key, because it never attempts to verify the token — only to decode what's already readable inside it.
The Formula
A JWT is three dot-separated segments: header, payload, and signature. This tool splits the token on its dots and Base64URL-decodes the first two segments — note that Base64URL is a different alphabet and padding convention from standard Base64 (it uses -/_ in place of +//, and typically omits padding), so it requires its own decoding logic rather than reusing standard Base64 decoding. Each decoded segment is then parsed as JSON and displayed formatted. The third segment, the signature, is never touched — verifying it would require the signing secret or key, which this tool has no way to obtain and never asks for.
A Worked Example
Decoding the standard example token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c produces the header {"alg": "HS256", "typ": "JWT"} and the payload {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}. Nothing about this output confirms the token is genuine — it's simply what was encoded inside it, readable by anyone who has the token string, regardless of whether they know the signing secret.
Decoding Is Not Verification — This Matters
This tool only decodes a JWT — it never verifies its signature, and it never asks for a signing secret or key. Decoding means reading the unencrypted, Base64URL-encoded header and payload — anyone can do this to any JWT, valid or not, without knowing anything secret. Verification means cryptographically confirming the token was issued by a trusted party and hasn't been tampered with, which requires the signing secret or public key and is a fundamentally different operation. Seeing readable, well-formed JSON come out of this tool tells you nothing about whether the token is authentic — a forged or expired token decodes exactly as cleanly as a valid one. If your application needs to trust a JWT's contents, it must verify the signature server-side with the correct key, not just decode it.
FAQ
- Does this tool verify the JWT signature?
- No, and it never will. This tool only decodes the header and payload — it never asks for a signing secret or key, and readable output does not mean the token is genuine.
- Why does Base64URL decoding need special handling?
- JWTs use Base64URL, not standard Base64 — it substitutes - and _ for + and / and typically omits padding, so decoding it requires converting back to the standard alphabet first.
- Is my token sent to a server?
- No, all decoding happens directly in your browser. Your token never leaves your device.