JWT Decoder

JWT Decoder takes a JSON Web Token and splits it into its three dot-separated segments: header, payload, and signature. Paste the token into the JWT token textarea and decoding is automatic, because there is no button to trigger. The tool converts each base64url segment back to bytes, feeds the header and payload through JSON parsing, and renders both as pretty-printed JSON. The stat tiles summarize the result with Header bytes, Payload bytes, Signature bytes, and Algorithm, which is read straight from the decoded header. The signature segment is displayed as raw hexadecimal bytes under the Header and Payload boxes, since signatures are binary and never meant for human eyes as text. Nothing is verified here; the hint under the input makes that clear with a Decode only, no signature verification note. Malformed input is caught with precise messages such as Expected 3 segments separated by a period, an invalid base64url segment, or a payload that fails JSON parsing, and these surface in a red alert plus a toast. Each decoded part can be downloaded separately as jwt-header.json, jwt-payload.json, or jwt-signature.txt.

1. 1

   Paste a token into the JWT token textarea; decoding happens automatically as you type.

2. 2

   Wait for the Header and Payload ResultBoxes to render pretty-printed JSON from the decoded segments.

3. 3

   Read the Algorithm stat to confirm the signing algorithm, then inspect the Signature (hex) box for the raw bytes.

4. 4

   If a red alert or Malformed JWT toast appears, check that your token has exactly three segments.

5. 5

   Use the download controls to save jwt-header.json, jwt-payload.json, or jwt-signature.txt individually.

• Inspecting the claims returned by an OAuth provider and mapping them to local user fields.
• Auditing the algorithm value when a service reports an unexpected token format.
• Debugging why middleware rejects a token by checking its three segments and byte sizes.
• Comparing the signature hex of two sessions to spot mismatched signing keys.
• Reviewing a token generated by a teammate before it ships in an integration test.
• Documenting the decoded payload structure for new developers on the auth team.

• Use this tool to inspect tokens you received, never tokens you are about to trust, since no signature verification happens.
• Strip stray whitespace from pasted tokens, because decoding expects exactly three dot-separated segments.
• Treat decoded payload data with the same care as the original token, especially sensitive claims.
• Compare the Algorithm stat across environments when debugging SSO to catch algorithm-swapping drift.
• Export each decoded part as a file when you need stable snapshots for a diff after a code change.
• Never paste production tokens into shared machines; run sensitive inspection in a private session.

• Confirm the Algorithm stat matches what your server expects before debugging middleware failures.
• Compare the hex Signature boxes of two tokens to spot signing-key mismatches at a glance.
• Use the payload download as a scratch file when mapping the claims consumed by your frontend.
• Remember the Decode only hint — never rely on this tool as proof that a token is authentic.