JWT decoder
Read a JWT’s header and payload to inspect its JSON fields locally, without verifying the signature.
How to use
- Paste a test JWT with a header, payload, and signature separated by dots.
- Click Decode JWT to view the header and payload as syntax-highlighted JSON.
- Inspect the fields without treating them as proof of authenticity; the responsible system must verify the signature.
How it works
Accepts up to 100,000 characters, with each JSON header and payload limited to 32 nesting levels and 10,000 values. Decoding does not establish signature validity, authenticity, token validity, or access rights. The token is excluded from session recovery.
When inspecting a test token, check payload fields such as sub, iss, and exp, and the alg field in its header.
Common questions
Can a decoded JWT be trusted?
No. Its contents may have been altered. Authenticity and authorization require signature verification and the rules of the system receiving the token.
Does decoding reveal encrypted content?
The tool reads Base64URL-encoded JSON headers and payloads from a three-part JWT. It does not decrypt tokens or cryptographically protected data.