JWT Decoder
Inspect JWT contents quickly while keeping token data local.
Runs locally in your browser.
Review important security-sensitive data and configurations independently.
Decoded output is readable data only. It is not proof that the JWT signature is valid.
Header
Payload
Token information
Use in code
Decode token segments for inspection only. Decoding does not verify authenticity; verify signatures in your auth system.
Decode JWT header and payload segments
TypeScriptPrimary API
atob()
Converts Base64URL segments and parses JWT header/payload JSON for inspection.
Built-in APILibrary: Web API
const [encodedHeader, encodedPayload] = token.split(".");
const fromBase64Url = (value) => {
const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
const pad = normalized.length % 4;
const padded = pad ? normalized + "=".repeat(4 - pad) : normalized;
return JSON.parse(atob(padded));
};
const header = fromBase64Url(encodedHeader);
const payload = fromBase64Url(encodedPayload);
console.log({ header, payload });Reference: Web API documentation
How to use
- Paste a JWT and decode it.
- Review the header for algorithm and key ID fields.
- Review the payload claims such as exp, aud, and sub.
Use cases
- Debug authentication issues during API development.
- Inspect token expiration and audience claims.
- Check whether expected custom claims are present.
Examples
- Header commonly includes alg and typ fields.
- Payload commonly includes exp, iat, and sub claims.
- Decoding reveals content only; it does not prove trust.
Limitations and caveats
- Decoding is not signature verification.
- Do not paste private keys, secrets, or credentials into the tool.
History
- JWT is defined by RFC 7519 as a compact claims representation for space-constrained contexts such as HTTP authorization headers.
- JWT is part of the JOSE standards family, which also defines signing and encryption formats used with tokens.
- Decoder tools became common developer utilities because JWT values are Base64URL-encoded and not directly human-readable.
Evolution and improvements
- Early JWT inspection often used manual scripts; browser utilities now decode header and payload quickly during debugging.
- Security practice has become clearer: decoding helps inspection, while trust requires signature verification against trusted keys.
- Modern JWT reviews typically check algorithm, issuer, audience, and time-based claims alongside proper signature validation.
FAQ
What is the difference between decoding and verification?
Decoding reads token contents. Verification proves the token signature is valid and trusted.
Can decoded payload data be trusted by itself?
No. Payload data can be manipulated unless signature verification is performed with trusted keys.