What is the structure of a JWT?

A JWT consists of three Base64URL-encoded segments joined by dots. The first segment is the header (algorithm and type). The second is the payload (claims). The third is the signature, which is the HMAC or RSA result over the first two segments.

Is it safe to paste a real JWT into this tool?

All decoding runs in browser RAM with no server requests. However, be cautious about pasting production access tokens into any browser-based tool, as browser extensions or clipboard monitoring software could read them.

What is the difference between HS256 and RS256?

HS256 uses a shared HMAC-SHA256 secret known to both issuer and verifier. RS256 uses an RSA private key to sign and a public key to verify. RS256 allows public verification without exposing the signing key.

Free & Private Online Browser Utility

JWT Decoder: Decode Header, Payload & Claims

A JSON Web Token (JWT) is a compact, URL-safe string made of three Base64URL-encoded segments separated by dots: the header, the payload, and the signature. This tool decodes the header and payload segments by reversing the Base64URL encoding and parsing the resulting JSON. It does not verify the signature. Decoding is not validation: the tool reads the contents of the token regardless of whether the signature is verified, the token has expired, or the issuer is trusted. Signature verification requires the secret key or public key that signed the token, which must be kept on a trusted server and never exposed to browser code. The tool's parseJwt function splits the token on dots, calls decodeBase64Url on the first two segments, and returns parsed JSON objects for the header and payload along with the raw signature string. The sample token in the tool has the header alg HS256 and typ JWT, and a payload with sub 1234567890, name Alex Doe, admin true, iat 1693400000, and exp 2080896000.

How to use

Step 1: Paste Your JWT

Paste any JWT string into the token input field. The three segments are separated by dots. A sample token is pre-loaded so you can see the output format immediately.
Step 2: Read the Decoded Segments

The header section shows the algorithm and token type. The payload section shows all claims. Registered claims such as iat (issued at), exp (expiry), and sub (subject) are displayed with human-readable timestamps where applicable.
Step 3: Inspect Claims and Copy

Copy any individual section as formatted JSON. Note that the signature string displayed is the raw Base64URL value from the token and has not been verified.

Options explained

Token Input

Accepts any three-segment dot-separated string. The tool validates that exactly three segments are present before attempting to decode.

When to use: Paste tokens from Authorization header values, cookie content, or URL query parameters.

Signature Verification (Secret Key)

Optionally provide the signing secret to attempt HMAC-SHA256 verification in the browser. Only HS256 tokens can be verified client-side.

When to use: Use only for development tokens where the secret is not sensitive. Never expose production signing keys in a browser.

Worked example

Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsZXggRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTY5MzQwMDAwMCwiZXhwIjoyMDgwODk2MDAwfQ.k_sample_signature_not_verified_locally

Output: Header: { "alg": "HS256", "typ": "JWT" } Payload: { "sub": "1234567890", "name": "Alex Doe", "admin": true, "iat": 1693400000, "exp": 2080896000 } Signature: k_sample_signature_not_verified_locally (not verified)

Decoded by splitting on dots and Base64URL-decoding each segment. The signature is shown as-is; this tool does not verify it.

Tips & limits

Decoding a JWT reveals its contents to anyone with the token string. JWTs should not contain sensitive data that is not already protected by transport encryption.
The exp claim is a Unix timestamp in seconds. Check this value to see when a token expires before assuming it is still valid.
This tool decodes only. It does not validate the signature, check expiry, or confirm the issuer. Always perform token validation on a trusted server.

Common problems

The tool shows an error about three dot-separated segments: A valid JWT always has exactly two dots forming three segments. Check that you copied the full token and that no characters were truncated.
The payload shows garbled characters instead of JSON: Some tokens use non-standard encoding or are not JWTs at all. Verify that the string is a genuine JWT and not a different token format such as an opaque reference token.

Frequently Asked Questions (FAQ)

Does this tool verify the JWT signature?: No. The tool decodes the header and payload by reversing the Base64URL encoding. It does not verify the signature. Decoding is not validation: a decoded token may still be expired, tampered with, or issued by an untrusted source.
What is the structure of a JWT?: A JWT consists of three Base64URL-encoded segments joined by dots. The first segment is the header (algorithm and type). The second is the payload (claims). The third is the signature, which is the HMAC or RSA result over the first two segments.
Is it safe to paste a real JWT into this tool?: All decoding runs in browser RAM with no server requests. However, be cautious about pasting production access tokens into any browser-based tool, as browser extensions or clipboard monitoring software could read them.
What is the difference between HS256 and RS256?: HS256 uses a shared HMAC-SHA256 secret known to both issuer and verifier. RS256 uses an RSA private key to sign and a public key to verify. RS256 allows public verification without exposing the signing key.

How to use

Step 1: Paste Your JWT

Step 2: Read the Decoded Segments

Step 3: Inspect Claims and Copy