JWT Decoder
Paste a token to read its header and payload as JSON. Nothing is uploaded, no signature check is attempted, and the tool keeps saying the thing that matters: reading a token proves nothing about whether it is authentic.
Processed as you paste — no button to press (Ctrl+Enter converts now / Esc clears)
Drop a file here, or — Ctrl+V a screenshot works too
Any file type · 100 MB maximum
Paste, drag and drop, or Ctrl+V a screenshot
What the three parts are
- Header — the signing algorithm and token type, Base64URL encoded
- Payload — the claims: subject, issuer, scopes, expiry and whatever else the issuer added
- Signature — computed over the first two parts with the issuer's key; not data, and not decodable
Readable is not the same as trusted
Anyone can construct a token with any payload they like: change "role":"user" to "role":"admin", re-encode, and hand it to a server that forgets to verify. Decoding is for inspection and debugging — never treat the contents as proof of anything until the signature has been checked server-side.
Equally, a token being readable is not a flaw. Base64 is an encoding, not encryption; the security of a JWT comes from the signature and from keeping the transport encrypted.
When this is useful
- Debugging auth — checking whether a token carries the scope you expected
- Expiry problems — reading
expandiatas actual timestamps - Integration work — confirming which claims an identity provider sends
Frequently asked questions
Why does it say the format is wrong?
A JWT has exactly two dots and three Base64URL segments. Pasted HTML, a truncated token, or a Bearer prefix all fail that shape check.
Can the signature be decoded?
No — it is computed bytes, not encoded JSON. Verifying it requires the issuer key and a real library, which is a server-side job.
Does this verify signatures?
No, and no client-side tool should claim to. Verification needs the secret or public key, and doing it in a browser means handing over the key that protects the tokens.