JWT Token Visualizer
Break a JWT into its header, payload and signature and view the decoded header and claims. Decoding only, the signature is not verified.
About this tool
Break a JWT into its header, payload and signature and view the decoded header and claims. Decoding only, the signature is not verified.
Example
Input: eyJ...header.eyJ...payload.sig
Output: HEADER + PAYLOAD JSON
Privacy
This tool runs entirely in your browser. Your data is processed locally and never uploaded to a server.
How to use this tool
- Paste a JWT string into the input field.
- Read the header, payload, and signature sections shown by the tool.
- Inspect the decoded header and claims to understand the token contents.
- Use the color coded split to see which part of the token you are looking at.
- Remember that this tool decodes only and does not verify the signature.
Step by step, what happens
- The tool takes the JWT string and splits it into its three dot separated parts.
- It base64url decodes the header and payload so you can read them as JSON.
- It leaves the signature as the raw third part because this page does not verify it.
- It presents the three sections separately and highlights them with different colors for quick scanning.
Worked example
Here is a simple JWT that contains a subject and an expiration claim, which is useful for checking how the token is structured.
Input: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjMiLCJleHAiOjE3MDAwMDAwMDB9.
- Paste the token into the visualizer.
- The tool splits the string into header, payload, and signature.
- It decodes the header into {"alg":"none","typ":"JWT"} and the payload into {"sub":"123","exp":1700000000}.
Output: Header: {"alg":"none","typ":"JWT"}
Payload: {"sub":"123","exp":1700000000}
Signature:
Tips and common mistakes
- If the token does not have two dots, it is not a valid JWT format for this viewer.
- This tool does not check whether the signature matches the header and payload, so do not treat a decoded token as trusted.
- If the header or payload looks unreadable, make sure the JWT uses base64url encoding and has not been copied with extra spaces.
- An empty signature can still appear in a JWT string, but that does not mean the token is safe to use.
Frequently asked questions
Does it verify the signature?
No, it only decodes. Signature verification requires the secret/key and should be done server-side.
Is my token uploaded?
No, decoding happens locally in your browser.
What is in a JWT?
Three Base64url parts: header (algorithm), payload (claims), and signature.
More Developer Tools Tools
Explore related calculators in this category
.htaccess Generator
Generate common .htaccess rules, force HTTPS, www redirect, and caching, with checkboxes.
API Key Generator
Generate random, secure API keys and tokens with an optional prefix. Cryptographically secure.
Apache Log Parser, Free Online Developer Tool
Parse Apache/NGINX combined access log lines into IP, time, request, status and size fields. Get instant results, the formula, and a clear example.
Barcode Validator
Validate EAN-13, EAN-8 and UPC-A barcode numbers using their check digit.
You Might Also Like
Popular tools from other categories
LLM Context Window Visualizer
Break down how system, history and response tokens fill a context window.
Prompt Token Simulator
See how a prompt's tokens fit within a model's context window.
Token Counter
Estimate the number of LLM tokens in a block of text.
1031 Exchange Calculator - Free Online
Free Calculate tax deferral in a 1031 exchange. Step-by-step solutions and formulas included. Fast, accurate, and free, with formula and example.
Can't Find the Right Calculator?
Try our AI Math Solver, type any problem in plain English and get instant step-by-step solutions.