JWT Decoder
Decode JWT header and payload locally — signature is not verified
This tool decodes JWTs only. It does NOT verify signatures.
Accepted upload: .txt · max 5 MB. Tokens are decoded locally and never leave your browser.
JWT
Paste a token — header and payload decode automatically.
No JWT yet
Paste a token or load the sample to inspect its header and payload.
Frequently asked questions
Common questions about the JWT Decoder.
How does JWT Decoder work?
Paste a compact JWT (header.payload.signature). ToolsArk Base64URL-decodes the header and payload and pretty-prints the JSON. The signature segment is shown raw and is not verified.
Does my token leave my device?
No. Decoding runs in your browser. Tokens are not uploaded to ToolsArk servers.
Does this verify JWT signatures?
No. This tool decodes only. It does not validate signatures, expiry, audience, or issuer claims. Never treat a decoded token as authenticated.
What input formats are supported?
Standard compact JWTs with three segments. Whitespace is stripped. You can upload a .txt file up to 5 MB. Tokens longer than 100,000 characters are rejected.
Why did decoding fail?
Common causes: missing or extra dots, invalid Base64URL, or header/payload that is not UTF-8 JSON. Binary segments that are not JSON will error.
Tags
Continue with these utilities
People frequently use these utilities together.