JWT Decoder & Validator

Decoding a JWT Is Not the Same as Verifying It

This is the single most important thing to understand about any JWT tool that runs in a browser, including this one: a JWT's header and payload are base64url-encoded, not encrypted. Decoding them requires no secret, no key, and no permission — anyone with the token text can read every claim inside it. When you click "Validate" here, the tool checks that the token has three dot-separated parts and that the header and payload are valid JSON and valid base64url — it does not and cannot cryptographically verify the signature, because that requires the issuer's secret key (for HMAC algorithms) or public key (for RSA/ECDSA), which never leaves your server and is never present in this page. The tool's own output says so explicitly after validation: "Signature verification requires the secret key, which is not available in the browser."

The practical consequence: a token that "decodes fine" here tells you nothing about whether it was legitimately issued. Anyone can construct a JSON object, base64url-encode it, and slap an arbitrary string after the second dot to produce something that decodes without error — the string of characters after the last dot doesn't have to be a real signature to pass basic structural inspection. Never treat a decoded payload as trustworthy input for an authorization decision unless the signature was verified against the correct key using a proper JWT library on the server that issued or expects the token.

What is JWT (JSON Web Token)?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and authorization in modern web applications and APIs. A JWT consists of three Base64-encoded components separated by dots (.), each serving a specific purpose in the token lifecycle.

Why This Isn't Quite Standard Base64

Each of the three JWT segments is base64url-encoded, not standard base64 — a distinction that trips people up when they try to decode a token with a generic base64 tool and get garbage or an error. Base64url swaps + for - and / for _ (both characters are unsafe in URLs and cookie values) and drops the trailing = padding entirely. This decoder's own base64url routine reverses both substitutions and re-derives the correct padding from the string length before calling the browser's base64 decoder — if you ever write your own JWT parsing code, that padding step is the part people most often get wrong.

Standard JWT Claims

Supported JWT Signing Algorithms

JWTs can be signed using different algorithms with varying security levels:

Frequently Asked Questions