Decode JWT

Decode the header and claims of a compact JWT.

freeworks offlinenothing uploaded
ToolJWT Decoder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

A compact token is split into header, payload, and signature segments, then each segment is Base64url-decoded; the first two are parsed as JSON. The operation is inspection only and does not verify cryptographic integrity or issuer policy.

  • Periods and unpadded Base64url keep compact tokens portable in HTTP headers.

Worked example

Decode HS256 JWT with user claims
Decode a JWT signed with HS256 to inspect its header, payload, and signature
Input
											eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
												Signature: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

HEADER
Alg: HS256
Typ: JWT

PAYLOAD
Sub: 1234567890
Name: John Doe
Iat: 1516239022

When to use this

API troubleshooting, fixture checks, and issuer/audience reviews decode JWTs.

Edge cases

  • A token with an invalid signature can still decode.
  • Unpadded Base64url needs length restoration before decoding.
  • A non-JSON payload is not a valid claims object even if it decodes.

References