JWT Decoder

JWT Decoder

Decode JSON Web Token header and payload segments locally without claiming that the token signature is valid.

Paste a fabricated three-segment test token, start processing, inspect Header and Payload JSON plus the raw third segment, then Copy all. Clear removes the input and result. There is no automatic decode, file picker or download.

eyJhbGciOiJub25lIn0.eyJzdWIiOiJ0ZXN0In0.

Header: {"alg":"none"}
Payload: {"sub":"test"}

Only the first two segments are decoded as UTF-8 JSON objects; arrays, primitives, invalid JSON and invalid UTF-8 fail. The third segment is displayed unchanged and may be empty: its encoding and signature are not checked. The browser decoder also accepts ordinary Base64 + and / and padding, so this is not a strict canonical Base64URL validator. Input is limited to 500000 UTF-16 code units before trimming. JSON parsing can round large numbers and retains only the last duplicate key. Claims, exp/nbf/iat types and times, issuer, audience, algorithm, keys and authorization are not validated. This is decoding, not decryption; five-segment JWE is unsupported. Treat claims as untrusted and use test tokens rather than live bearer credentials.