JWT decoder

About JWT decoder

Splits a JWT and pretty-prints the header and payload in your browser. It does not verify signatures or call a remote decoder.

JWT debugging is usually a paste into someone else's decoder. That is fine for a tutorial token and a bad habit for the refresh token you just copied from a network panel. These strings carry sub, exp, scopes, and whatever else the issuer stuffed into the middle third. I wanted a page that splits the dot-separated parts, base64url-decodes the header and payload, and prints them as indented JSON without shipping the string to a server I do not control. Most of the time I am not doing cryptography at all, I am answering whether exp is in the past or whether aud matches the API I thought I was calling.

Decoding is not validation. A tampered payload still decodes cleanly because base64 is not cryptography. If you need to know whether the token is trustworthy, verify the signature where you already hold the key, or ask the issuer. I will not fetch JWKS from the internet to chase rotating keys, and I will not add a shared-secret box that invites people to paste production HMAC keys into a web form. The job here is reading claims on your machine: expiration, audience, a surprising alg field, a nested object you did not expect in the payload. Treat pretty JSON as a flashlight, not a stamp of approval.

The signature segment stays on the page as text only. Showing it is honest; pretending I verified it would not be. Use this when a colleague sends 'why is this 401' and the answer is in exp, not in signature math. Use your backend, your CLI, or your identity provider's docs when you actually need verification. Close the tab when you are done; the token was only ever in memory. If you need the header or payload in a ticket, copy the formatted blocks and redact anything you would not paste into Slack on purpose.

How to use JWT decoder

1. 1Paste the JWT into the input field, with or without the Bearer prefix trimmed away.
2. 2Read the pretty-printed header and payload JSON in the output panes.
3. 3Copy either block if you need it in a ticket, a note, or a formatter.

What it won't do

• ·Decode only. No signature verification, no JWKS fetch.
• ·Malformed base64 or non-JSON header or payload shows an error, not a partial guess.

Common questions

Related tools

• JSON formatterPretty-print, minify, and validate JSON, with the parse error's line and column.
• Base64 textEncode or decode plain text as Base64 (not the image tool).
• Hash generatorSHA-256 and SHA-1 of pasted text, via the browser's Web Crypto API.