JWT Decoder
Split a token and inspect its Base64url header and payload as JSON. The view helps debug claim formatting during an authentication integration, without representing a verifier’s acceptance decision.
- Runs in your browser
- Nothing is uploaded
- No signup; device limits apply
Loading the tool. If it does not appear, reload this page.
How to use this tool
Paste the dot-separated token. The decoder translates the URL-safe alphabet, supplies padding and reads UTF-8; start with a public sample rather than exposing a usable production credential.
Results and examples
If the header shows alg as HS256, that is the token’s own declaration. Decoding alone cannot establish a correct HMAC, an allowed algorithm or whether an expiry claim should be accepted.
Limitations
- No signing key is supplied and signature, issuer and audience checks are not performed.
- Encrypted content or malformed JSON cannot be displayed as ordinary JWT claims.
Fields
| Field | Guidance and constraints |
|---|---|
| JWT | Check the unit and format displayed beside this field. |
| Header | Check the unit and format displayed beside this field. |
| Payload | Check the unit and format displayed beside this field. |
| Signature (raw) | Check the unit and format displayed beside this field. |
Data handling
Processing stays in the current browser tab; the site does not upload tool input for the calculation itself.
Sources
Frequently asked questions
What does the alg field tell me?
If the header shows alg as HS256, that is the token’s own declaration. Decoding alone cannot establish a correct HMAC, an allowed algorithm or whether an expiry claim should be accepted.
Can this output authorize a login?
No signing key is supplied and signature, issuer and audience checks are not performed. Encrypted content or malformed JSON cannot be displayed as ordinary JWT claims.
