JWT Decoder: instructions, examples and limits

What it does

Base64url-decodes the header and payload as UTF-8 JSON. No key or signature verification is performed.

Decode a JWT locally when debugging its header and payload structure, without implying that the token is valid or trusted.

How to use it

1. 1

   Paste the token into the local decoder.

2. 2

   Inspect the header, claims and any readable timestamps.

3. 3

   Verify the token with the issuing service and a trusted key separately before using it for access decisions.

How the result is produced

Base64url-decodes the header and payload as UTF-8 JSON. No key or signature verification is performed.

Important limits

Decoding does NOT verify authenticity, validity, security or authorization. Do not trust decoded claims. Input stays in this tab and is never sent to analytics. Limit 100,000 characters. No input is executed.

Checks before sharing or relying on the result

• Decoding only reverses Base64URL encoding; it does not verify a signature, issuer, audience or expiry.
• Treat the token as sensitive and do not paste it into screenshots, URLs or support messages.
• Encrypted or non-JWT tokens will be rejected rather than guessed.

Choosing the next step

Treat these tools as a local scratchpad. Validate the format before transforming it, keep secrets out of shared screenshots and remember that a decoded token is not an authenticated token. Use the smallest input that reproduces the problem.