JWT DECODER =========== Use this JWT decoder to decode a JSON Web Token header and payload. Inspect JWT claims and copy the JSON; signature and expiration are not verified. This JWT decoder reads the first two Base64URL segments of a JSON Web Token and displays its header and payload as JSON. Use it to inspect test claims and algorithm metadata during debugging. Decoding does not authenticate the token or check its expiration. OVERVIEW & METADATA ------------------- Canonical URL: https://million.tools/jwt-decoder/ Markdown Copy (.md.txt): https://million.tools/jwt-decoder.md.txt Plain Text Copy (.txt): https://million.tools/jwt-decoder.txt API Endpoint: https://million.tools/api/v1/run/jwt-decoder (POST, Keyless, 60 req/min) SEO Title: JWT Decoder Online | Inspect Header and Payload Alternative Names: JWT Header & Payload Viewer, JSON Web Token Decoder, JWT header decoder, JWT payload decoder, JWT claims viewer Category: Encoding (https://million.tools/encoding/) Tags: #JWT Application Category: DeveloperApplication Platform: Web (All modern desktop and mobile browsers, requires JavaScript) Price: Free ($0.00 USD, no registration or sign-up required) Live Calculation: Supported (Auto / Live toggle enabled by default) Usage Statistics: 1 use | 26 views Published: 2026-11-09 Last Updated: 2026-11-09 Author: Egor Volchenko (Developer & Author) KEY FEATURES ------------ - Decode Base64URL JWT header and payload segments - Display decoded header and payload together as JSON - Return null for a segment that cannot be parsed - Inspect token claims without a signing-key input - Update edited input with Auto / Live or Run - Copy decoded JSON and clear text PARAMETERS & INTERFACE CONTROLS ------------------------------- Input Parameters & Options: - input_text: JSON Web Token (JWT). - input_encoding: Hex | Hex (Ignore Non-Hex Characters) | Base64 | UTF-8 | UTF-16LE | UTF-16BE | Windows-1251 (Cyrillic) | Windows-1252 (Latin 1) | ... (42 options) Output Fields & Metrics: - result: Decoded JWT Header & Payload. Controls: Run, Clear, Copy, Fill test data, Auto / Live INTERACTIVE EXAMPLE (TEST VECTOR) --------------------------------- Settings: - Input Encoding: UTF-8 JSON Web Token (JWT): eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature Decoded JWT Header & Payload: { "header": { "alg": "HS256" }, "payload": { "sub": "123" } } HOW TO USE JWT DECODER ---------------------- Follow these steps to check the input and read the result. Inspect a token’s readable claims: 1. Type or paste the token itself without a Bearer prefix into JSON Web Token (JWT). 2. Leave Input Encoding: at UTF-8. The decoder reads JWT segments directly; changing this selector does not select another JWT format. 3. Keep Auto / Live on to update the result as you edit. To process it manually, turn Auto / Live off and click Run. 4. Read Decoded JWT Header & Payload and check the result before using it. 5. Click Copy to copy the result. Use Clear where shown, or a field’s clear control, to clear the text before starting again. For a synthetic example, enter eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vIn0.test. The decoded header contains "alg": "HS256" and the payload contains "sub": "demo". The final segment is a dummy value, not a valid signature. Separate readable claims from trust: Fields such as sub, iss, and exp are claims made by the token. This form does not check a signing key, issuer, audience, or time constraints. Treat the displayed values as untrusted until your application validates them. Recognize partial or malformed input: A normal signed compact token has three dot-separated parts. This implementation can still decode two parts and returns null for a header or payload it cannot parse. Neither readable output nor null output is a complete token-validity decision. FREQUENTLY ASKED QUESTIONS -------------------------- Q: Do I need a secret to decode a JWT? A: No. The header and payload of an ordinary signed JWT are Base64URL-encoded and can be read without the signing key. A key is needed for signature verification, which this form does not perform. Q: Does this tool verify the JWT signature? A: No. It only decodes the header and payload. A tampered token can still produce readable output; your application must verify the signature with an appropriate key. Q: Will it tell me whether the token has expired? A: No. An exp claim may appear in the payload, but the decoder does not compare it with the current time or enforce nbf and iat rules. Q: Why is the header or payload null? A: That segment could not be parsed as JSON after Base64URL decoding. Check that you pasted the token itself and that the segments are complete. A null value is not an authentication result. Q: Can it decrypt an encrypted JWT? A: This form has no decryption-key controls and does not implement JWE decryption. It is intended for inspecting readable header and payload segments of a signed token. Q: Is it safe to paste an active access token? A: The form sends the token to the calculation API, including updates made with Auto / Live enabled. Use synthetic, expired, or redacted samples instead of an active bearer credential. RELATED TOOLS ------------- - URL Encode (https://million.tools/url-encode/): Percent-encode a URL component or text value using UTF-8. Convert spaces, plus signs, and reserved characters before inserting a value into a URL. - URL Decode (https://million.tools/url-decode/): Decode percent-encoded text and URL components. Convert UTF-8 byte escapes to readable text while preserving literal plus signs. - Base32 Encode (https://million.tools/base32-encode/): Encode text, Hex, or Base64 bytes as standard RFC 4648 Base32. The output uses uppercase letters, digits 2–7, and padding where needed. - Base32 Decode (https://million.tools/base32-decode/): Decode standard Base32 to UTF-8 text. Uppercase and lowercase input work; preserve required padding and remove internal whitespace. ABOUT THE AUTHOR ---------------- Egor Volchenko — Developer & Author Hi! I’m a WordPress developer with over 10 years of experience. I love Tailwind CSS, clean code, and intuitive interfaces. I’m currently working on million.tools — a service with convenient online tools for everyday tasks. I’m building it from scratch with great attention to detail and user experience. Links: x.com (https://x.com/egorleet) | github.com (https://github.com/egorleet) | t.me (https://t.me/egorleet) | instagram.com (https://www.instagram.com/egorleet) | facebook.com (https://www.facebook.com/egorleet/) | egorleet.blog (https://egorleet.blog/) | mastodon.social (https://mastodon.social/@egorleet) | twitch.tv (https://www.twitch.tv/egorvolchenko) | stackoverflow.com (https://stackoverflow.com/users/31679135/egor-volchenko) | reddit.com (https://www.reddit.com/user/Vegetable_Window9185/) | youtube.com (https://youtube.com/@egor-volchenko)