UlvixorJWT Decoder
Paste a JWT (JSON Web Token) and view its decoded header and payload as readable JSON. This tool only decodes the token's contents — it does not verify or validate its signature.
How it works
- Paste the full JWT into the input field (header.payload.signature format).
- The token is split into its three dot-separated segments.
- The header and payload are decoded from Base64URL and shown as formatted JSON.
- The signature is shown as-is, without decoding or verification, since validating it requires the issuer's secret key.
- If the token doesn't match the expected format, you'll see a clear error message.
Use cases
- Quickly inspect the claims (data) contained in an authentication token.
- Debug authentication issues in applications that use JWTs.
- Check a token's expiration date (exp) or issuer (iss) during development.
- Understand the structure of a JWT received from an API or third-party service.
Use cases
- Quickly inspect the claims (data) contained in an authentication token.
- Debug authentication issues in applications that use JWTs.
- Check a token's expiration date (exp) or issuer (iss) during development.
- Understand the structure of a JWT received from an API or third-party service.
Common mistakes
- Believing that decoding the payload is the same as validating the token.Decoding only shows the content; it doesn't confirm the signature is valid or that the token hasn't been tampered with. For that you need to verify the signature with the issuer's key.
- Pasting a production JWT with sensitive data into third-party tools.A JWT's payload isn't encrypted, only encoded, so anyone with the token can read it. Avoid sharing real tokens containing sensitive information.
- Pasting only part of the token, for example without the signature.A complete JWT has three dot-separated segments (header.payload.signature). If one is missing, the tool shows a format error.
Frequently asked questions
No. This tool only decodes the token's header and payload so you can read its content. It doesn't validate the signature or guarantee the token is authentic or hasn't been tampered with. That requires the issuer's secret or public key, which should never be shared with third-party tools.
The token is processed entirely in your browser and never sent to any server. Even so, we recommend not sharing production tokens containing sensitive data with any external tool, since anyone with the token can read its contents (it's encoded, not encrypted).
If the token doesn't have three dot-separated segments, or if any segment can't be decoded as valid Base64URL/JSON, the tool shows a clear error message instead of an incorrect result.
A standard JWT (JWS) is signed, not encrypted: the payload is only Base64URL-encoded, so anyone can read it. The signature verifies that the content hasn't been altered — it doesn't hide it. If you need confidentiality, you should use JWE (JSON Web Encryption) instead.
Alternatives
Libraries like jsonwebtoken (Node) or PyJWT (Python) let you decode and, more importantly, verify a token's signature within your own backend. Use this tool only for quick inspection during development, not for validating tokens in production.