JWT Decoder
Inspect JWT header and payload locally—no signature verify.
Decoded header, payload, and signature will appear here.
JWT Decoder splits a JSON Web Token into its header, payload, and signature segments and pretty-prints the JSON claims in your browser. Use it to inspect structure and expiry during development—never as a substitute for server-side signature verification.
How it works
The tool splits the token on dots, Base64url-decodes the first two segments, and parses them as JSON. The signature segment is shown as-is. No Web Crypto verification is performed; decoding is for readability and debugging only.
Benefits
- Instant header and payload inspection without server round-trips
- Pretty-printed JSON for registered and custom claims
- Clear security warnings about secrets and verification
- Sensitive-tool defaults with history opt-in only
Use cases
- Debug access tokens during local API development
- Inspect exp, aud, and scope claims in support tickets
- Compare header algorithms before integrating an identity provider
- Teach JWT structure without installing CLI utilities
Best practices
- Verify signatures on your backend before trusting claims
- Use short-lived tokens and rotate signing keys regularly
- Avoid pasting production tokens on shared or recorded machines
- Treat decoded payloads as untrusted until cryptographically verified
Common mistakes
- Assuming a valid-looking payload means the token is authentic
- Pasting live session tokens into online tools on untrusted networks
- Ignoring exp and nbf when debugging authorization failures
- Confusing Base64url JWT segments with encrypted or signed content you can trust blindly
Privacy
JWT decoding runs locally in your browser and is not uploaded to ToolHub. Because tokens are sensitive, history is off by default and requires explicit opt-in. Clear history and the workspace before sharing your browser profile.
Frequently asked questions
- Does the JWT Decoder verify signatures?
- No. This tool only Base64url-decodes the header and payload for inspection. Signature verification requires your issuer's secret or public key and is intentionally not performed here.
- Is it safe to paste production JWTs here?
- Avoid pasting live production tokens when possible. JWTs often contain identity claims and can be replayed until they expire. This tool runs locally, but tokens may remain in memory and optional history on your device.
- Why is history off by default for this tool?
- JWTs are sensitive credentials. ToolHub marks this tool as sensitive so on-device history requires an explicit opt-in and shows a warning before storing tokens.
- What do header and payload contain?
- The header usually lists the signing algorithm and token type. The payload holds claims such as subject (sub), issuer (iss), audience (aud), issued-at (iat), and expiry (exp).
- Can I trust a decoded JWT?
- Never trust payload claims without verifying the signature on your backend. Anyone can craft a JWT with arbitrary claims if verification is skipped.
- What is Base64url and how is it different from Base64?
- JWTs use Base64url encoding, which replaces + with - and / with _ and typically omits padding. Standard Base64 decoders may fail unless the alphabet is normalized.
- Does this tool upload my token to a server?
- No. Decoding happens entirely in your browser. Your token is not sent to ToolHub servers for this tool.
- How do I check whether a token expired?
- Look for the exp claim in the payload. It is a Unix timestamp in seconds. Compare it to the current time—but only after you verify the signature on a trusted server.
Related tools
Hash Generator
crypto
SHA-256/512 hashing for text and files via Web Crypto.
- hash
- sha256
- sha512
- checksum
Base64 Encode/Decode
developer
Unicode-safe Base64 encode/decode for text and files locally.
- base64
- encode
- decode
- developer
Unsigned JWT Builder
security
Build unsigned JWTs for learning—never for production.
- jwt
- security
- education
- alg-none
Caesar Cipher
security
Adjustable-shift Caesar cipher, encode and decode.
- caesar
- cipher
- encode
- decode
HTTP Headers Parser
security
Parse raw HTTP headers into a structured list.
- http
- headers
- parser
- debugging
Password Strength Checker
security
Local entropy and checklist-based password strength check.
- password
- security
- strength
- entropy