JWT Decoder

Inspect header and payload of a JSON Web Token locally. Nothing is uploaded.

The JWT Decoder Base64URL-decodes a token's header and payload locally and never verifies the signature — no key is needed, because a signed JWT (RFC 7519) is encoded, not encrypted.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "ada",
  "name": "Ada Lovelace",
  "iat": 1700000000,
  "exp": 1893456000
}

Signature (not verified)

signature-not-verified

What does the JWT Decoder do?

A JWT decoder splits a compact token into header, payload and signature so you can inspect claims such as sub, exp and alg. It does not verify signatures and should not be used as authentication.

How does the JWT Decoder work?

The token is split on dots. Each of the first two segments is Base64URL-decoded in this browser, then pretty-printed if the result is JSON. The signature is shown as-is and never sent anywhere.

Does this upload my data?

No. This page never sends your input to a server — formatting, decoding and hashing all run in this tab, on this device.How that works.

Frequently asked questions

Is the signature verified?

No. Verification needs a secret or public key and a cryptographic check. This tool only inspects the readable parts of the token.

Is it safe to paste production tokens?

The token never leaves this device through LocalFirstTools. Still treat live tokens as secrets: do not screenshot them, and prefer expired or dummy tokens when you can.

Why is alg none a problem?

Some libraries historically accepted unsigned tokens when alg was none. This decoder will still show the payload; it will not tell you the token is trustworthy.

What if decoding fails?

The segments may not be valid Base64URL, or the token may be truncated. Paste the full three-part string, including the signature segment.

Do one job

Inspect a JWT payload

Guides

Browse allencoding toolsor thefull tool directory.