JWT Decoder Online | Inspect Header and Payload

Q: Does this tool verify the JWT signature?

No. It only decodes the header and payload. A tampered token can still produce readable output; your application must verify the signature with an appropriate key.

Q: Will it tell me whether the token has expired?

No. An exp claim may appear in the payload, but the decoder does not compare it with the current time or enforce nbf and iat rules.

Q: Why is the header or payload null?

That segment could not be parsed as JSON after Base64URL decoding. Check that you pasted the token itself and that the segments are complete. A null value is not an authentication result.

Q: Can it decrypt an encrypted JWT?

This form has no decryption-key controls and does not implement JWE decryption. It is intended for inspecting readable header and payload segments of a signed token.

Q: Is it safe to paste an active access token?

The form sends the token to the calculation API, including updates made with Auto / Live enabled. Use synthetic, expired, or redacted samples instead of an active bearer credential.

This JWT decoder reads the first two Base64URL segments of a JSON Web Token and displays its header and payload as JSON. Use it to inspect test claims and algorithm metadata during debugging. Decoding does not authenticate the token or check its expiration.

Auto / Live

JSON Web Token (JWT)

Input Encoding:

Decoded JWT Header & Payload

How to use JWT Decoder

Follow these steps to check the input and read the result.

Inspect a token’s readable claims

Type or paste the token itself without a Bearer prefix into JSON Web Token (JWT).
Leave Input Encoding: at UTF-8. The decoder reads JWT segments directly; changing this selector does not select another JWT format.
Keep Auto / Live on to update the result as you edit. To process it manually, turn Auto / Live off and click Run.
Read Decoded JWT Header & Payload and check the result before using it.
Click Copy to copy the result. Use Clear where shown, or a field’s clear control, to clear the text before starting again.

For a synthetic example, enter eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vIn0.test. The decoded header contains "alg": "HS256" and the payload contains "sub": "demo". The final segment is a dummy value, not a valid signature.

Separate readable claims from trust

Fields such as sub, iss, and exp are claims made by the token. This form does not check a signing key, issuer, audience, or time constraints. Treat the displayed values as untrusted until your application validates them.

Recognize partial or malformed input

A normal signed compact token has three dot-separated parts. This implementation can still decode two parts and returns null for a header or payload it cannot parse. Neither readable output nor null output is a complete token-validity decision.

Frequently asked questions

Do I need a secret to decode a JWT?

No. The header and payload of an ordinary signed JWT are Base64URL-encoded and can be read without the signing key. A key is needed for signature verification, which this form does not perform.

Does this tool verify the JWT signature?

Will it tell me whether the token has expired?

Why is the header or payload null?

Can it decrypt an encrypted JWT?

Is it safe to paste an active access token?

API — JWT Header & Payload Viewer

Automate this tool directly from your scripts, CI/CD pipelines, or backend applications via HTTP POST.

No API Key Required 60 req/min

POST https://million.tools/api/v1/run/jwt-decoder

Request Parameters (JSON / Form Data)

start (or input)

JSON Web Token (JWT)

Type: string Default: —
input_encoding

Input Encoding

hex hex_ignore_non_hex base64 utf-8 utf-16le utf-16be windows-1251 windows-1252

Type: string Default: utf-8

bash — cURL

curl -X POST https://million.tools/api/v1/run/jwt-decoder \
  -H "Content-Type: application/json" \
  -d '{"start":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature"}'

const response = await fetch('https://million.tools/api/v1/run/jwt-decoder', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "start": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature"
  }),
});

const data = await response.json();
console.log(data.result);

import requests

response = requests.post(
    'https://million.tools/api/v1/run/jwt-decoder',
    json={
        "start": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature",
    },
    timeout=15,
)

data = response.json()
print(data['result'])

$ch = curl_init('https://million.tools/api/v1/run/jwt-decoder');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode([
        'start' => 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature',
    ]),
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

echo $response['result'] ?? '';

{
    "status": "success",
    "tool": "jwt-decoder",
    "service": "jwt_decoder",
    "result": "{\n    \"header\": {\n        \"alg\": \"HS256\"\n    },\n    \"payload\": {\n        \"sub\": \"123\"\n    }\n}",
    "results": {
        "result": "{\n    \"header\": {\n        \"alg\": \"HS256\"\n    },\n    \"payload\": {\n        \"sub\": \"123\"\n    }\n}"
    }
}

Egor Volchenko Developer & Author

Hi! I’m a WordPress developer with over 10 years of experience. I love Tailwind CSS, clean code, and intuitive interfaces. I’m currently working on million.tools — a service with convenient online tools for everyday tasks. I’m building it from scratch with great attention to detail and user experience.

JWT Decoder