JWT Decode

What this tool does

A JSON Web Token (JWT) is a compact, three-part string used to carry claims — such as a user ID, an expiration time, or permission scopes — between a client and a server. This tool decodes a JWT's header and payload back to readable JSON entirely in your browser. It does not verify the signature; it only reads the two segments that are plain Base64url-encoded JSON, not the cryptographically signed part.

When you need it

• Inspecting what's actually inside an access token or ID token your application received, while debugging an authentication flow.
• Checking which algorithm (alg) and claims a third-party API's token uses before writing code to consume it.
• Confirming a token you generated in a test environment contains the claims you expected, without needing the signing key on hand.
• Understanding an expired-token or invalid-claim error by seeing exactly what the token says, independent of whether it's cryptographically valid.

How a JWT is structured

A JWT is three Base64url-encoded segments joined by dots: header.payload.signature. The header typically names the signing algorithm (alg) and token type (typ); the payload carries the actual claims — arbitrary key-value data about the subject, issuer, expiration, and anything else the issuer chose to include. The signature is a cryptographic value computed over the header and payload using a secret or private key, and it's the only part that proves the token is authentic and unmodified.

This tool decodes the first two segments — plain JSON, readable by anyone without any key — and reports the algorithm and token type it finds in the header. It leaves the signature alone entirely, since checking it correctly requires the issuer's secret or public key, which a generic browser tool has no way to obtain or verify against.

Why unverified claims can't be trusted

Because the header and payload are just Base64url-encoded JSON, not encrypted, anyone can construct a JWT with any claims they like — a forged token decodes just as cleanly as a legitimate one. The signature is what separates a real, unmodified token from a forgery, and this tool doesn't check it. Use it to read and debug a token's contents, never to authenticate or authorize a request; that decision belongs to server-side code using a proper JWT library that verifies the signature against the correct key and algorithm.

What the tool reports on invalid input

A leading Bearer prefix, as copied from an Authorization header, is ignored. A token that doesn't have exactly three dot-separated parts is rejected immediately, since that structure is required by the JWT format itself. If a segment isn't valid Base64url or doesn't decode to valid JSON, the tool reports exactly which segment failed and why — and still shows whichever segment did decode successfully, rather than discarding everything on a partial failure.

Limits

Input is capped at 2 MB of text, far more than any real JWT needs. This tool never contacts a server, which matters since a real token can carry sensitive session data — but always be cautious pasting a production token into any browser tool, including this one, and prefer test tokens where possible.