JWT Decoder
Decode a three-part JWT header and payload in the browser with base64url parsing—no signature verification, not JWE.
Decoded
Tips
Three parts only
A standard JWT has three base64url segments: header, payload, and signature. This tool expects that shape—not JWE.
Decode is not verify
Anyone can read header and payload. Signature verification with the correct key is required to trust a token.
Claims are timestamps
exp, iat, and nbf are often Unix seconds—use Timestamp Converter to read them as dates.
Client-side only
Parsing runs in your browser; the token is not sent to a Toolomix JWT API.
Header and payload decode
Base64url-parses the first two segments and shows them as readable JSON.
No signature verification
The signature segment is not cryptographically checked.
Three-part JWT only
Supports compact JWS-style tokens with three parts—not encrypted JWE.
What this tool does
JWT Decoder base64url-parses a three-part JWT and shows the header and payload as JSON.
It does not verify signatures, does not validate trust, and does not decode JWE encrypted tokens.
How to use
Copy the JWT
Copy the full three-part string: header.payload.signature.
Paste into the input
Paste exactly—extra whitespace can break parsing.
Inspect header and payload
Review the decoded JSON. Treat claims as untrusted until verified elsewhere.
Supported inputs and output
Input: a compact three-part JWT string. Output: decoded header JSON and payload JSON.
Not supported: JWE, signature verification, token signing/encoding, or file upload.
Processing and privacy
Parsing runs in your browser with client-side base64url decoding of header and payload.
The token is not sent to Toolomix for decoding—there is no jwt-decoder API endpoint for this page.
Limitations
Known limits
- No signature verification
- Three-part JWT only—not JWE
- Decode only—cannot create or sign tokens
- Does not prove expiry or audience claims are authentic
- Pasted text only—no file upload
Troubleshooting
If decoding fails, confirm you pasted three segments separated by dots and that header/payload are valid base64url JSON.
If you need to trust a token, verify the signature with your issuer's keys in your application—this page will not do that.
Frequently Asked Questions
Does this tool verify the JWT signature?
No. It only base64url-decodes and displays the header and payload. It does not verify the signature or confirm the token is trustworthy.
Is my token uploaded?
No. Decoding runs in your browser. There is no jwt-decoder API call for this page. Still avoid sharing production tokens in screenshots.
Does it support JWE?
No. This tool expects a three-part JWT (header.payload.signature). Encrypted JWE tokens are not supported.
Can I create or sign a JWT here?
No. This page is decode-only. It does not encode or sign tokens.
What do exp and iat mean?
iat is issued-at and exp is expiry, usually Unix timestamps in seconds. Decoding them does not prove they are authentic.
Why does my token fail to decode?
Paste all three dot-separated parts without extra spaces. Invalid base64url or non-JSON payload content will fail.
Is a decoded token safe to trust?
No. Readable claims do not mean the token is valid. Only signature verification (and your app's claim checks) can establish trust.
Try Other Free Tools
Try it now
Paste a three-part JWT to inspect header and payload. Signature is not verified.
