JWT Decoder NZ
This tool decodes a JSON Web Token, or JWT, so you can read what is inside it, splitting it into its header and payload and showing the claims in readable form. JSON Web Tokens are the standard way modern web applications carry identity and authorisation information between a server and a client. After you log in, the server often issues a JWT that your browser sends back with each request to prove who you are. A token is three parts separated by dots: a header describing the algorithm, a payload containing the claims such as the user ID and an expiry time, and a signature that lets the server confirm the token has not been tampered with. The header and payload are simply Base64url-encoded JSON, not encrypted, so anyone can read them, which is exactly what this tool does. You paste a token, and the calculator decodes the header and payload and displays the JSON neatly, so you can inspect the claims, check the expiry, or debug an authentication problem. Everything runs in your browser and nothing is uploaded, which matters because tokens often grant access and should not be shared. The result updates as you paste. Use it to debug login and API issues, to read the claims a token carries, or to learn how JWTs are structured. Two important points: this tool decodes but does not verify the signature, since that requires the secret or public key held by the server, so a decoded token is not a validated one. And because the payload is only encoded, never put secrets in a JWT, as anyone holding the token can read them.
Decodes the header and payload only. The signature is NOT verified, so a decoded token is not validated. Never put secrets in a JWT; the payload is readable by anyone.
How it works
The token is split at its two dots into three parts. The first two, the header and payload, are Base64url-encoded JSON. The decoder converts each from Base64url back to text and formats the resulting JSON. The third part, the signature, is left alone, since verifying it requires the server's secret or public key.
Worked example
Pasting a standard example token decodes the header to show the algorithm HS256 and type JWT, and the payload to show claims like the subject 1234567890, the name John Doe and an issued-at timestamp. The signature is shown as present but not checked, since verification needs the signing key the server holds.
Related calculators
- Base64 Encoder: encode and decode.
- JSON Formatter: format JSON.
- Hash Generator: generate hashes.
- Unix Timestamp: decode expiry times.