Developer

JWT Decoder

Decode a JWT into header and payload JSON. The signature segment is ignored, never verified. Paste a token and copy the claims. Processing stays on this page.

JWT Decoder

Decode a JWT header and payload. The signature is not checked.

ShareX LinkedIn Facebook

JWT token

Decoded JWT

Paste a JWT to decode header and payload.

Output actions

Ready to copy output once your result appears.

Header JSON, payload JSON, unread signature

JWT Decoder splits a token on periods and prints the first segment and the second segment as JSON. It rewrites the URL-safe alphabet, pads the segment, and calls atob before JSON.parse. The third segment is never read, so a signature is not checked, an exp number is not compared with the clock, and alg is only shown, not enforced.

How to read a token

1Paste the full token into JWT token. A space at either end is trimmed. The Decoded JWT panel refreshes on each change, and there is no Run button.
2Read the Header block, then the Payload block. Both are printed with a two-space indent. Copy output copies the labels and both blocks together.
3Leave the signature in place or omit it. Two segments are enough. A string with no period at all stops with the format error.

What it is good for

• Reading alg, typ, and the claim names in a Bearer token copied from a request.
• Checking that a pasted value is even a dotted token before you hand it to a library.
• Lifting the raw iat or exp integer so you can interpret it somewhere else.

Example

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTUxNjIzOTAyMn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Output

Header:
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "1234567890",
  "name": "Ada",
  "iat": 1516239022
}

The third segment is left untouched. iat stays a JSON number. The name Ada is ASCII, so it survives the byte-oriented decode.

What each period-separated piece is

A JWT is three pieces of text joined by periods: a header, a payload, and a signature. This page only needs the first two. It splits the trimmed field on every period, then decodes index 0 and index 1. Index 2 and anything after it are discarded, which means a fourth piece, a leftover period, or a long signature does not change the JSON. The header in the sample is the object with alg HS256 and typ JWT. The payload is the object with sub, name, and iat. Property order follows the JSON text, because JSON.parse keeps the order it reads and JSON.stringify writes that order back.

The format error is the sentence Invalid JWT format. Expected header.payload.signature. The condition behind that sentence is only that the split has fewer than two pieces. A token shaped as header.payload, with no signature, still decodes. A single word with no period does not. Empty input does not use that error. It shows Paste a JWT to decode header and payload. and that same sentence is what Copy output will copy until a token is present, because the panel publishes its text on every change, including the empty state.

Base64URL padding before JSON.parse

Each segment is Base64URL, not the standard alphabet. The decoder replaces minus with plus and underscore with slash, then padEnd extends the string with equals signs until the length is a multiple of four. atob then turns that into a binary string, and JSON.parse reads that string. The sample header needs no padding characters after that rewrite, and the payload object comes back with two-space indentation. There is no control for four spaces, tabs, or a single-line payload. If you want a different layout, copy the payload object into the JSON formatter.

The Base64 encode/decode page calls btoa and atob on the text you type, with no minus-to-plus rewrite. A JWT segment that still contains underscore or minus is the wrong input for that page. Standard Base64 of an ASCII string is a different job, and HTTP Basic credentials use that standard alphabet. This decoder will not build a Basic header for you.

Claims you can read and claims you cannot trust

The payload is whatever JSON the token carried. Common names such as sub, name, iat, exp, nbf, aud, and iss are not special here. They print if they are present and they are absent from the panel if the token omitted them. iat 1516239022 is a Unix second count, not a formatted date. Paste that integer into the timestamp converter when you want a calendar time. This page does not call that converter, and it does not treat exp as expired or fresh.

Nothing in the panel is an authentication result. alg is displayed, including the literal none if that is what the header says, and the page does not refuse it. The signature bytes are not recomputed, no secret is accepted, and no public key field exists. A captured request that still contains a Bearer token is a debugging artifact. The guide Turn a browser request into Python or JavaScript is about reproducing the request, not about trusting the claims. Read the payload here, then decide outside this page whether the token should be shared.

Broken segments and non-ASCII claims

If either segment is not valid Base64 after the rewrite, or the decoded text is not JSON, the panel is replaced by Failed to decode token. Ensure the header and payload are valid Base64URL JSON. There is no line number and no partial header when the payload fails, because both parses sit in one try block. Extra equals signs that you typed are left in place before padding; atob then decides whether the segment is acceptable.

atob returns one JavaScript character per byte. It does not UTF-8-decode the payload. An ASCII name such as Ada is unchanged. A UTF-8 payload that contains é (the bytes C3 A9) parses as the two characters Ã©, not as é. If those bytes do not form JSON the decoder shows the failure sentence instead. Do not use this panel to prove that a display name round-tripped. There is also no download control on this tool, only Copy output.

Rules and limitations

Input is one trimmed string. At least one period is required. Segments 0 and 1 are Base64URL-decoded and JSON.parsed. Later segments are ignored. Output indent is always two spaces.

The page does not verify signatures, enforce alg, or interpret exp, nbf, or iat. Non-ASCII UTF-8 claim text is not decoded as Unicode. Copy output includes the placeholder sentence while the field is empty.

Common problems

If you see the format sentence, the field has no period. Add the payload segment. A missing signature is not the cause, because two segments are accepted.

If a name looks like Ã©, the payload was UTF-8 and atob exposed the raw bytes. The token may still be valid in a library that UTF-8-decodes JSON. This panel will not repair that.

Frequently asked questions

Does this check the JWT signature?

No. The third segment is ignored. No secret, key, or algorithm check runs. alg is printed as a JSON property and is not enforced, including when the value is none.

Can I omit the signature segment?

Yes. The error text mentions header.payload.signature, but the check only requires two pieces separated by a period. header.payload decodes. A string with no period does not.

Why is a non-ASCII name garbled?

atob yields one character per byte and does not UTF-8-decode. A UTF-8 é in the payload shows up as Ã©. ASCII claims such as Ada match the original text.

Will exp tell me the token is expired?

No. exp and iat stay numbers. Compare them with a clock yourself, or paste the integer into the timestamp converter. This page never reads the current time.

Is my input uploaded or saved?

This tool processes input in your browser and does not save its input or output to local storage. Copy and download are user actions. The site uses analytics for page and action metadata and may use ads and production error reporting; see the Privacy Policy for those services.

About this tool

Maintained by Toolbench. For large or deeply nested files, split the input into smaller batches and verify representative results before using them in an import or application. Report reproducible problems through Contact.

Guides

Turn a browser request into Python or JavaScript
Capture one request as cURL, convert it to requests or fetch, and review credentials and browser restrictions.

Next steps