Utiltown

JWT Decoder

Decode a JWT header and payload entirely in your browser. We never validate signatures, never upload, never store your token. Paste a JSON Web Token, hit Decode, and read a clean, pretty printed breakdown of its header and payload claims.

All computations run locally in your browser, no data uploaded to server. 
  
  
 
How To Use
 
     
  1. Copy any JWT — for example from a login flow, an Authorization: Bearer header, a test fixture, or a development console.
    2.  
  2. Paste it into the field above. The input accepts whitespace around the token and ignores differences in line wrapping.
    3.  
  3. Click Decode. The header and payload are rendered as two readable, pretty printed JSON blocks.
    4.  
  4. Click Copy result to copy the combined header and payload JSON to your clipboard.
    5.  
 
 
 
Usage Example
 
Take a compact token such as:
 
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.E9Fs_JrhJ2nL8512aXgGMDbVQaB5Bc1FcrWAiW9xrJY
 
Decoding it reveals two parts:
 
Header
{
  "alg": "HS256"
}

Payload
{
  "sub": "123"
}
 

The header tells you how the token was signed, and the payload holds
        the claims — the pieces of identity and metadata the token represents.
        The long third segment is the signature, which this tool intentionally
        shows nothing about.

 
 
 
Frequently Asked Questions
  
What is a JWT?
 
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe way to carry claims between two parties, most often used for authentication and authorization. It is built from three Base64Url-encoded segments separated by dots: header.payload.signature. The header describes the signing algorithm, the payload contains the claims such as a user ID or expiry time, and the signature lets a server verify the token has not been modified.
  
Why does this tool not validate the signature?
 
Validating a signature requires the signing key, which is only held by the server that issued the token. A client-side decoder cannot, and should not, verify it. This tool is an inspection utility: it shows you the readable contents of the header and payload so you can debug, learn, or develop against a token, without pretending to be a trusted verification endpoint.
  
Does the decoder detect if a token has been tampered with?
 
No. Because this tool never verifies the signature, it cannot tell you whether a token is genuine or has been altered. It only displays what is written in the header and payload. If you need to prove a token is authentic and unmodified, verify it on your server with the correct signing key.
  
Is my token uploaded anywhere?
 
No. The entire decode happens locally in your browser using plain JavaScript — nothing is sent to a server, logged, or stored. You can paste sensitive development tokens here with complete confidence, and clear the page or close the tab whenever you like.
  
Which algorithms are supported?
 
Every algorithm. This decoder simply reads the alg header claim to tell you what algorithm the issuer used — HS256, RS256, ES256, none, or anything else — but it does not execute or verify the signing algorithm. Because no cryptographic work is performed, the tool works with tokens produced by any algorithm.
  
What are the header, payload, and signature?
 
The header is a small JSON object identifying the token type and the signing algorithm, typically {"alg":"HS256"}. The payload is the JSON object of claims — identity, permissions, and metadata such as sub, iat, and exp. The signature is a Base64Url-encoded value computed over the header and payload with the signing key; it is what lets a server detect tampering.