Last updated ·Published ·By the WiserWork team
JWT Decoder
Decode a JWT and inspect its header and payload — decoding only, not signature verification
| Claim | Value |
|---|---|
| Paste a JWT to see claims | |
Split a JSON Web Token into its three parts and read the header and payload as formatted JSON, with every claim also listed in a table below.
What is the JWT Decoder?
A JWT is three Base64URL segments joined by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. This page splits on the dots, turns Base64URL back into standard Base64 by swapping the dash and underscore characters and re-adding padding, then decodes and parses the first two segments. The signature is shown as text only. It is never checked and there is nowhere to supply a key, so this tool decodes tokens rather than verifying them.
Key Features
- Header, Payload and Signature shown as three clickable panels
- Decoded JSON is syntax colored by value type
- Claims table lists every payload key beside its raw value
- Decodes as you type, with a sample token loaded to start
- Copy Decoded puts the header and payload on your clipboard
Common Use Cases
- Checking which scopes or roles a token from your own test environment carries
- Confirming an auth library put the issuer and audience you expected in
- Reading the exp claim to work out why a session ended early
- Showing a teammate why a JWT payload is readable by whoever holds it
How to Use the JWT Decoder
- Replace the sample token in the box with the one you want to inspect.
- Click the Payload panel to read the claims as indented JSON.
- Switch to Header to check the alg and typ fields.
- Scroll to the Claims table for a flat key and value listing.
- Press Copy Decoded to grab header and payload, or Clear to wipe the box.
Tips for Best Results
- Never paste a live production token into any website; a JWT is a bearer credential.
- Convert iat, exp and nbf yourself, since they are Unix seconds and shown here unchanged.
- Use an expired or deliberately fake token when you only need to inspect the shape.
- Do not trust the alg field in the header; it was chosen by whoever minted the token.
Why Use WiserWork's JWT Decoder?
Reading a token is a two-minute job that people often push to a server-side script because they are unsure what a web page will do with it. Here the work is a split, an atob call and a JSON.parse, all in your browser, and the tool transmits nothing. The honest caveat is that this page, like most ad-supported pages, loads third-party scripts, which is reason enough on its own to keep live credentials off it.
Who Uses the JWT Decoder?
Backend and mobile developers debugging an auth flow, QA engineers checking what a test account's token grants, and anyone learning how OAuth and OpenID Connect tokens are assembled. Security reviewers reach for decoders like this to demonstrate that a payload is encoded, not encrypted.
Frequently Asked Questions
Does this tool verify the signature?
No. It displays the signature segment as text but never recomputes it, and there is no field for a secret or a public key. Verification has to happen on your server with the real key.
Is a JWT encrypted?
Usually not. The common signed form, JWS, is Base64URL-encoded, and encoding is not encryption, so anyone holding the token can read every claim. There is a separate encrypted form, JWE, which has five segments instead of three.
Is it safe to paste a real token here?
Treat it as unsafe. A JWT is a bearer credential, so whoever holds it can act as you until it expires, and any page you paste it into has it in memory. Stick to expired or test tokens.
Why does my token show as invalid?
The decoder needs exactly three dot-separated parts, and each of the first two must be Base64URL that parses as JSON. A truncated copy or a stray line break is almost always the cause.
What is Base64URL and why is it different?
It is Base64 with plus and slash replaced by dash and underscore, and the trailing padding dropped, so a token can sit safely in a URL. The tool reverses those swaps before decoding.
Does it tell me whether the token has expired?
No. The exp claim appears exactly as written, as seconds since 1 January 1970 UTC, and comparing it against the current time is left to you.
What do sub, iss, aud and jti mean?
They are registered claims from the JWT specification: subject, issuer, intended audience and a unique token identifier. Anything else in the payload is defined by whoever issued the token.
Why does the sample token say admin is true?
It is the standard demonstration payload, and it makes the point neatly. Anyone can edit that value and re-encode the payload, so only a verified signature stops a tampered token from being accepted.
What does an alg of none mean?
It marks an unsecured token with an empty signature. A decoder will happily display one, which is precisely why servers must reject any algorithm they were not expecting rather than trusting the header.
Can I edit a token here and re-sign it?
No. This page is read-only, with no encoder and no signing step. Producing a token that will be accepted requires the issuer's key.
Decoding a JWT tells you what it claims. Only verification tells you whether to believe it, and that belongs on your server with the signing key, not in a browser tab you found on the internet.