Developer tools ● Local processing

JWT Decoder

Decode a JSON Web Token header and payload locally without verifying its signature.

Preparing tool…

Guided walkthrough

Understand the readable parts of a JWT.

Consider a fictitious header {"typ":"JWT"} and payload {"sub":"demo-user"}. These are explanatory JSON fragments, not a token to paste.
Read the explanation before running the tool yourself. This walkthrough does not load an example or start an inspection.

Illustrative example

A three-part JWT contains a header, payload, and signature. The decoder displays the first two as JSON and marks the signature unverified.

How to read the result

Decoding is not signature verification or authentication. Claims are untrusted until properly verified by the intended system. This tool does not decrypt five-part JWE tokens; never share a real bearer token.

This is a static educational walkthrough. It does not fill fields, generate values, inspect your browser, or read storage. Use fictitious, non-secret data for practice. Never share passwords, keys, tokens, or cookie values. These explanations are not a security audit or certification.

✓ Local processing✓ No account✓ Inputs processed here✓ Free

Quick answer

Decode the Base64URL header and payload of a three-part signed JWT so you can inspect their contents. Five-part encrypted JWE tokens are not supported. This tool does not verify the token signature or claims.

The page and its assets load from the site; this operation uses your entered values only in this browser and does not send them to a calculation endpoint.

How to use it

Paste a three-part JWT to decode its Base64URL header and payload. Decoding does not verify the signature, issuer, audience, or expiry; never trust claims until your application validates them.

Limits

A decoded header or payload is untrusted until the token’s signature and relevant claims are validated by the receiving application.

Frequently asked questions

Does decoding a JWT prove it is authentic?

No. Decoding only reads the encoded parts. The receiving application must validate the signature and relevant claims.

Why are five-part tokens not decoded?

A five-part compact token is a JWE whose payload is encrypted. This tool only reads the header and payload of three-part signed JWTs; decrypting a JWE requires the appropriate key.

Is a JWT payload encrypted?

Not necessarily. A signed JWT payload is generally readable by anyone who has the token; encryption is a separate token form.

Why use a test or expired token?

If the JWT is a bearer access token, anyone who has it may be able to use it to access its resources. This decoder runs locally but does not verify the token; keep active credentials in tools you trust.

Sources and references

These references document the cited standard or browser API; they do not validate the tool’s output.