JWT Decoder
Decode JWT header and payload locally — signature is not verified
This tool decodes JWTs only. It does NOT verify signatures.
Accepted upload: .txt · max 5 MB. Tokens are decoded locally and never leave your browser.
JWT
Paste a token — header and payload decode automatically.
No JWT yet
Paste a token or load the sample to inspect its header and payload.
About this JWT decoder
Paste or upload a JSON Web Token to view the decoded header and payload as formatted JSON. This tool does not verify signatures or trustworthiness—it only Base64URL-decodes the middle sections. Copy header or payload separately, or download jwt-decoded.json. Input is limited to 100,000 characters.
How to use
- Paste a JWT string or upload a file containing the token.
- Read the formatted header and payload panels when decoding succeeds.
- Copy header or payload individually as needed.
- Download jwt-decoded.json for both parts in one file.
What decoding does not do
A JWT has three dot-separated segments: header, payload, and signature. Decoding reveals JSON claims such as iss, exp, or sub, but anyone can decode a JWT. Without signature verification using the issuer’s key, you cannot treat the token as authentic or untampered.
Common uses
- Debug exp or aud claims during local API development.
- Inspect opaque tokens from browser storage before fixing client bugs.
- Share redacted claim structure with teammates (avoid pasting live secrets).
Tips
- Never use this page alone to authorize access—verify signatures on your server.
- Tokens in URLs or logs may be sensitive; treat decoded output like a password.
- If decoding fails, check for extra quotes, Bearer prefixes, or truncated paste.
Privacy
JWT strings are decoded in your browser only. ToolsArk does not receive tokens for processing or storage. Avoid decoding production tokens on untrusted shared computers.
Limitations
- No signature verification (HS256, RS256, etc.) and no JWKS fetching.
- Maximum input length 100,000 characters.
- Malformed Base64URL or invalid JSON inside segments produces errors, not partial guesses.
Frequently asked questions
Common questions about the JWT Decoder.
How does JWT Decoder work?
Paste a compact JWT (header.payload.signature). ToolsArk Base64URL-decodes the header and payload and pretty-prints the JSON. The signature segment is shown raw and is not verified.
Does my token leave my device?
No. Decoding runs in your browser. Tokens are not uploaded to ToolsArk servers.
Does this verify JWT signatures?
No. This tool decodes only. It does not validate signatures, expiry, audience, or issuer claims. Never treat a decoded token as authenticated.
What input formats are supported?
Standard compact JWTs with three segments. Whitespace is stripped. You can upload a .txt file up to 5 MB. Tokens longer than 100,000 characters are rejected.
Why did decoding fail?
Common causes: missing or extra dots, invalid Base64URL, or header/payload that is not UTF-8 JSON. Binary segments that are not JSON will error.
Tags
Continue with these utilities
People frequently use these utilities together.