JWT decoder

How it works

A JWT is three base64url segments separated by dots: header, payload and signature. The tool splits on the dots, restores the base64url alphabet (dashes back to plus, underscores to slash, padding added) and decodes each segment as UTF-8 JSON. Header and payload are pretty-printed; the signature is shown but never checked, because verifying it needs the secret or public key only the issuer holds. Numeric time claims — iat, exp and nbf — are also listed as UTC dates next to their raw epoch seconds. A segment longer than 6,000 characters, a token that is not two or three parts, or a segment that fails to parse each get a specific message.

Worked example

The public sample token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c decodes to a header of alg HS256 with typ JWT, and a payload of sub 1234567890, name John Doe and iat 1516239022, which the tool shows as Thu, 18 Jan 2018 01:30:22 GMT. The third segment is displayed as-is and never verified, and the page states that a decoded token is not proof that it is valid.

Questions and answers