SECURITY WORKSPACE
JWT Decoder
Inspect unverified JWT contents.
Input is processed on this site only when you run the tool. The application does not save inputs or results. Signature not verified.
input.txt
Result result.json
A little clarity goes here.
Run the tool to see your result.
Result preview
UTF-8 text, at most 16384 bytes per input. Tab leaves the editor. Plain text disables syntax colors. Browser textareas may normalize line endings to LF.
{"decode":{"inputMode":"text","options":[]}}{"decode":{"input":"eyJhbGciOiJub25lIn0.eyJzdWIiOiJleGFtcGxlIn0.","output":"{\"notice\":\"Signature not verified.\",\"header\":{\"alg\":\"none\"},\"payload\":{\"sub\":\"example\"},\"dates\":{}}","options":[]}}A QUICK WALKTHROUGH
A familiar workflow,
with room to focus.
Use a fictional compact JWT; avoid sharing live bearer tokens.
Decode to inspect the original header and payload values.
Treat all claims and date states as untrusted. Signature not verified.
When to use JWT Decoder
Read the header and claims of a fictional compact JWT when diagnosing an integration or learning its structure.
Read the result
Signature not verified. Treat all decoded claims as untrusted until your application verifies the signature and required claims with the correct keys and policy.
SEE IT IN PRACTICE
Worked examples
Sample input. A result you can inspect.
Decode example
Input
eyJhbGciOiJub25lIn0.eyJzdWIiOiJleGFtcGxlIn0.
Expected result
{"notice":"Signature not verified.","header":{"alg":"none"},"payload":{"sub":"example"},"dates":{}}{"kind":"jwt","title":"Decoded contents \u00b7 signature not verified","blocks":[{"label":"Header","value":"{\n \"alg\": \"none\"\n}"},{"label":"Payload","value":"{\n \"sub\": \"example\"\n}"}],"fields":[],"note":"Decoding does not establish authenticity, authorization or token validity.","schema":1}Formats, limits and common errors
Check all three segments, Base64URL spelling and unique object keys. Unsupported JWT extensions require another implementation.
- At most 16 KiB and three compact segments. Header/payload must be unique-key JSON objects with a nonempty alg string.
- Canonical, unpadded Base64URL. alg none requires an empty signature; other algorithms require a nonempty signature segment.
- Encrypted JWTs, critical extensions and b64=false are unsupported. No signature, issuer or audience validation is performed.
- NumericDate states use server UTC time and support exact millisecond precision within years 0001–9999. utcSecond is a whole-second display. Unsupported precision, malformed or out-of-range dates show unavailable and a warning.
- JSON numbers stay in their original spelling. Dates are informational and cannot establish authentication.
- Input: 16,384 UTF-8 bytes per text field. Output: at most 524,288 UTF-8 bytes; serialized responses have a separate 1 MiB ceiling. Size/work failures return no partial result.