JWT Decoder

What is the JWT Decoder?

A JWT decoder splits a JSON Web Token into its three parts — header, payload and signature — and decodes the header and payload into readable JSON so you can inspect the claims. It decodes only; it does not verify the signature.

How the JWT Decoder works

A JWT is three Base64URL segments joined by dots: header.payload.signature. The decoder Base64URL-decodes the first two segments into JSON. Crucially, decoding is not verification — anyone can read a JWT, so the signature must be checked on your server with the secret or public key before the token is trusted. Decoding here happens locally in your browser.

Worked example

header → { "alg": "HS256", "typ": "JWT" } payload → { "sub": "123", "exp": 1735689600 }

Key terms

Claim:

A piece of information in the payload, e.g. sub, exp, iss.

Base64URL:

URL-safe Base64 (- and _) used for each JWT segment.

Signature:

A keyed hash over header.payload that proves the token was not altered.

Common mistakes to avoid

• Trusting a decoded token — always verify the signature server-side first.
• Assuming the payload is encrypted — it is only Base64URL-encoded and readable by anyone.
• Pasting production tokens that grant real access into tools you do not control.
• Ignoring exp — an expired token must be rejected even if the claims look right.
• Accepting alg: none — reject it; it is an unsigned-token vulnerability.

Detailed FAQ