How to Decode a JWT and Check Its Signature

What JWT Decoder does

JWT Decoder helps you inspect a three-part token without treating decoding as proof that the token is authentic. It separates the token into header, payload, and signature data, then can optionally attempt signature verification when you provide a secret. This makes it useful for checking token structure, reading claims, and investigating why a token may not behave as expected.

How to decode and check a JWT

1. Copy the token as text and paste it into the tool. Remove surrounding spaces if needed. An empty or whitespace-only input produces an unsuccessful result.

2. Check that the token has exactly three parts separated by periods. A token with a different number of segments is outside the supported format and produces an unsuccessful result.

3. Run the decoder. The first two segments are base64url-decoded, read as UTF-8 JSON, and shown as the header and payload. The third segment is decoded as signature data, while its original segment text is also retained.

4. Review the decoded fields and any reported issues. If the header and payload contain objects, the tool can surface selected information such as the algorithm, token type, issuer, subject, audience, and time-related claims.

5. If you need a signature check, enable verification and supply the secret. The tool uses the algorithm identified in the decoded header and reports an outcome such as a valid or invalid signature. If verification is requested without a secret, it is skipped and an issue is recorded. Verification is optional and is disabled by default.

How to interpret the result

A successful decoding result gives you separate header, payload, and signature data. Header and payload content must be valid base64url, UTF-8, and JSON for the result to succeed. Problems in either of those first two segments are collected as issues and make the overall result unsuccessful. An invalid nonempty signature segment is also reported as an issue; an empty third segment does not add a signature issue in this implementation.

Reading claims tells you what the token contains, but decoding alone does not establish authenticity, integrity, security, or token validity. Use the optional verification result for the signature check, and interpret it together with the supplied secret and the algorithm named in the header. A verification request without a secret cannot complete and is recorded as an issue.

Worked example

A developer is investigating a three-part access token and wants to inspect its claims before checking whether its signature matches the supplied secret.

Paste the complete token, confirm that it has three period-separated segments, run the decoder, and review the returned sections. Enable verification and provide the secret only when a signature check is needed.

The result contains separate header, payload, and signature data, plus any decoding issues and, when requested with a secret, a signature verification outcome.

Limitations

• The tool supports only three-part tokens. Malformed encoding or JSON can make decoding unsuccessful, and verification cannot proceed when it is requested without a secret.
• Decoded claims describe token contents; they do not by themselves prove authenticity or validity. Interpret signature verification separately.

Common errors

• A frequent input mistake is pasting an empty value or a string with the wrong number of period-separated segments. Paste the complete three-part token and confirm that it contains exactly two periods before running the decoder.

FAQ

Can I decode any JWT format?

Yes, when the token contains exactly three period-separated segments and the first two decode as UTF-8 JSON. Other segment counts or decoding problems produce an unsuccessful result.

Does decoding verify the JWT signature?

Verification is optional and disabled by default. When enabled, provide the secret so the tool can attempt verification with the algorithm identified in the decoded header.

What happens if I enable verification without a secret?

When verification is requested without a secret, verification is skipped and an issue is recorded.

Which JWT claims can I inspect?

The tool can surface selected information when decoded values are objects, including the algorithm, token type, issuer, subject, audience, and standard time-related claims.