JWT Decoder
Decode and inspect three-part JSON Web Tokens with optional secret-based signature verification.
Run tool
The online JWT Decoder allows you to inspect the structure and contents of a JSON Web Token directly in your browser interface. A standard token consists of three base64url-encoded segments separated by periods: the header, the payload, and the signature.
When you enter a three-part token, the tool decodes the first two sections into readable UTF-8 JSON text. You can immediately examine essential token metadata such as the signing algorithm and token type in the header, as well as claims like issuer, subject, audience, expiration timestamp, and issued-at time in the payload.
In addition to base decoding, the tool supports optional signature verification. When you enable verification and provide the matching shared secret or key string, the tool validates the cryptographic signature against the decoded header algorithm. If a segment contains malformed base64url characters, invalid JSON formatting, or an incorrect signature, clear diagnostic notices display in the output panel to assist troubleshooting.
Instructions
- Paste your three-part JSON Web Token into the JWT field.
- Optionally check the Verify signature box if you want to validate the token signature.
- Enter your secret key in the Verification secret field when verification is enabled.
- Click the run button to view the decoded header, payload claims, and signature details in the result panel.
Examples
- Decoding an HS256-encoded token without verification to inspect the token type, signing algorithm, and user payload claims.
- Enabling the signature verification option and providing a shared secret key to confirm that the token signature matches its header and payload.
FAQ
What input format does the JWT Decoder expect?
The tool requires a text token formatted with exactly three period-separated segments representing the base64url-encoded header, payload, and signature.
Can I decode a token without verifying its signature?
Yes. Signature verification is optional and disabled by default. The tool decodes and displays the header and payload text regardless of whether a secret is provided.
What happens if verification is enabled without a secret key?
If you check the verification option but leave the secret field empty, signature verification is skipped and an explanatory issue notice is shown in the output.
Why does the tool show a decoding error?
An error appears when the token does not contain exactly three segments, when segment text is not valid base64url, or when the header or payload fails to parse as valid JSON.