JSON Web Token (JWT) Decoder

Decode and inspect compact JSON Web Tokens in real time. Examine Header parameters, Payload claims, standard registered timestamps, and signature segments without uploading sensitive tokens to any third-party server.

JWT Token Inspector & Decoder

Decoded locally in client memory. Never uploaded to any remote server or persisted.

Fictional Test Tokens (Sample):

Paste Encoded JWT (Compact 3-Part Token)

Crucial Security Notice: Decoding a JWT merely parses Base64URL data to readable JSON. Decoding is NOT signature verification. Anyone can alter claims or forge unsigned tokens. Only verify tokens with a cryptographically verified secret key on your server.

The Anatomy of a Compact JSON Web Token (RFC 7519)

A compact JWT consists of three distinct segments joined by periods (.):

1. Header (Algorithm & Token Type)Typically contains alg (e.g. HS256, RS256) and typ ("JWT"). It tells the receiving party which algorithm to use when verifying the signature.

2. Payload (Claims & Data)Contains the statements asserted by the token issuer. Includes registered claims (iss, sub, exp, iat) and arbitrary custom claims like user roles and tenant IDs.

3. Signature (Cryptographic Assurance)Generated by running the chosen algorithm (e.g., HMAC-SHA256) over the base64-encoded header and payload concatenated with a dot, using the server's private secret key.

Decoding is NOT Verification

A critical distinction in web application security is that decoding simply converts Base64URL to JSON text. It does not prove that the token came from a trusted server or that the contents have not been modified. An attacker can easily craft any payload, encode it, and send it to your server.

Always ensure that backend services verify the cryptographic signature using your verified secret key and an explicit algorithm whitelist before granting access to protected resources.

JWT Decoder Frequently Asked Questions

Does decoding a JWT prove that the token is authentic?

No! Decoding merely unpacks the Base64URL encoding so that claims can be viewed as JSON. Anyone can craft a payload and claim to be an administrator. Only cryptographic signature verification using your secret key on a trusted server proves authenticity.

Are my tokens safe when pasted into this tool?

Yes. All parsing happens entirely within your local browser memory using client-side JavaScript. Tokens are never transmitted to any server, never logged, and never saved in cookies or browser storage.

What is Base64URL encoding?

Base64URL (RFC 7515) is a modified variant of standard Base64 designed specifically for URLs and HTTP headers. It replaces "+" with "-" and "/" with "_", and omits trailing "=" padding characters.

Why does my token say "alg": "none"?

An algorithm header of "none" means the token is unsigned. If a backend server accepts tokens with alg: none, attackers can forge arbitrary claims and bypass authentication completely.