JWT Decoder
Paste a JSON Web Token into the JWT field and press Decode. The tool splits the token on dots, base64-decodes the first two segments, and shows pretty-printed Header and Payload JSON so you can inspect claims without verifying the signature.
Updated 2026-08-03 · developer
About this tool
This JWT decoder expects a token with at least two dot-separated parts. It normalizes URL-safe base64, parses each part as JSON, and prints Header then Payload. It does not validate signatures or expiry. Bad tokens show Decode failed with the error message, or Invalid JWT when there are fewer than two parts.
How to use
- Open the decoder: Load this page so the JWT textarea and Decode button appear.
- Paste the token: Replace the sample token with your JWT (three segments separated by dots is typical).
- Decode: Click Decode to parse the header and payload segments.
- Read the JSON: Review the result block labeled Header: and Payload:, or fix the token if decode fails.
Common use cases
- Peek at claims inside an access or ID token while debugging an auth flow.
- Confirm algorithm and typ values in the header before wiring a verifier.
- Copy payload fields such as sub or exp into notes without a CLI.
Tips
- Click Decode after you paste; the result does not refresh until you decode again.
- Signature verification is out of scope—treat decoded claims as untrusted display only.
FAQ
Does this tool verify the JWT signature?
No. It only base64-decodes and pretty-prints the header and payload for inspection.
What if my token has only one segment?
The decoder requires at least two parts and shows Invalid JWT otherwise.
Why do I see Decode failed?
A segment was not valid base64 or not valid JSON after decoding. Check the pasted token.
Is my JWT sent to a server?
Decoding runs in your browser when you click Decode; you do not need an account.