JWT Decoder & Inspector

About this tool

Paste a JWT to decode and pretty-print its header and payload claims. Note: this decodes only, it does not verify the signature (never trust an unverified token).

Example

Input: eyJ...header.eyJ...payload.sig

Output: HEADER + PAYLOAD JSON

Privacy

This tool runs entirely in your browser. Your data is processed locally and never uploaded to a server.

How to use this tool

1. Paste a JWT string into the input box.
2. Click decode to parse the token.
3. Read the header and payload sections that appear below.
4. Check the signature note before using any claims in your app.

Step by step, what happens

1. The tool splits the JWT into its three dot-separated parts.
2. It Base64URL decodes the header and payload sections.
3. It pretty-prints the decoded JSON so the fields are easy to read.
4. It shows that the signature is not verified, so the token should not be trusted for security decisions.

Worked example

Suppose you want to inspect a token and see which user and roles it claims to contain.

Input: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4ifQ.signature

1. Paste the token into the decoder.
2. The tool decodes the header and payload into readable JSON.
3. It leaves the signature unverified and warns you not to trust the token just because it decoded successfully.

Tips and common mistakes

• This tool only decodes the token, so do not use it to confirm authenticity or integrity.
• A token that decodes correctly can still be forged or tampered with.
• If the input is malformed, make sure it has three dot-separated parts and that the first two parts are valid Base64URL data.
• Use the decoded payload for quick inspection, but always verify JWTs in your backend code before trusting claims.

Frequently asked questions