About this tool
Split a JSON Web Token into header, payload, and signature without verifying the signature. Inspect claims like exp, iss, and sub during auth debugging.
This tool does not validate signatures — that needs your secret or public key on the backend. For test tokens with HMAC algorithms, use the JWT Generator.
Prefer expired or redacted samples over long-lived production tokens.
How to use
- Paste a three-part JWT (`header.payload.signature`) into Input.
- Click Decode.
- Inspect the JSON Output: `header`, `payload`, and raw `signature` string.
- Use JWT Verifier separately if you need an HMAC signature check (test secrets only).
Example
Inspect claims without verifying the signature
Input
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQyIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzAwMDAwMDAwfQ.JEQ-_rag3sSMZZk5hfFdc34-L6VsMcMIohn1KDFuG-w
Output
{
"header": {
"typ": "JWT",
"alg": "HS256"
},
"payload": {
"sub": "user_42",
"role": "admin",
"iat": 1700000000
},
"signature": "JEQ-_rag3sSMZZk5hfFdc34-L6VsMcMIohn1KDFuG-w"
}Decode never checks the signature — a forged token will still “decode.”
Limitations
- No signature verification and no trust decision — treat decoded claims as untrusted data.
- Encrypted JWTs (JWE) are not supported; only compact JWS-style three-part tokens.
- Does not validate `exp` / `nbf` / audience; the verifier adds limited expiry hints when verifying HMAC.
Related guides
2Related tools
4Frequently asked questions
Does the JWT Decoder verify signatures?
No. This tool only decodes the header and payload segments. Signature verification requires your secret or public key and must be performed in your application backend.
When should I use the JWT Decoder?
Use it during auth debugging to inspect claims like exp, iss, aud, and sub. Paste an expired or test token rather than a live production credential when possible.
Is the JWT Decoder free to use?
Yes. Completely free with no signup required.
Is my token sent to a server?
No. Decoding happens entirely in your browser. The token is not uploaded or stored.
Can I create tokens with codefunc?
Yes. Use the JWT Generator to sign test tokens with HMAC algorithms (HS256, HS384, HS512).