Development Tools
JWT Decoder — View Header, Payload & Signature
Decode JWT tokens free to readable JSON header and payload. Valid Format badge only — no signature verification. Paste a token and decode now.
JWT Token Decoder on FYN Tools is a free Development Tools utility. Open JWT Token Decoder in your browser — no signup required. Paste a JWT or load the sample, click Decode JWT, and see header and payload as pretty-printed JSON plus the raw signature — a Valid Format or Invalid Format badge reflects structure only. Signature verification is not performed. Related: JSON Formatter.
Privacy & processing: Decoding uses atob on base64url segments and JSON.parse in your browser. The token is never sent to a server. Valid Format means parseable structure, not cryptographic authenticity.
TL;DR: Paste a JWT or load the sample, click Decode JWT, and see header and payload as pretty-printed JSON plus the raw signature — a Valid Format or Invalid Format badge reflects structure only. Signature verification is not performed.
Reviewed by FYN Tools Editorial · Guides ·
Data input / output
| Inputs | JWT string (header.payload.signature) or sample token via Load Sample |
|---|---|
| Outputs | Pretty JSON header, pretty JSON payload, raw signature, Valid/Invalid Format badge |
| Formats | Base64url-encoded three-part JWT |
| Limits | Decode only — no signature verification; malformed tokens show Invalid Format |
| Processing | Client-side (browser atob + JSON.parse) |
How to Use the JWT Token Decoder
- Paste your JWT into the token textarea or click Load Sample.
- Click Decode JWT.
- Read the Valid Format or Invalid Format badge.
- Inspect the Header card for alg and typ fields.
- Inspect the Payload card for claims like sub, iat, and exp.
- Copy header, payload, or signature individually as needed.
What is a JWT Token Decoder?
Paste a three-part JWT and click Decode JWT. The header and payload segments are base64url-decoded (replacing - with + and _ with /) then parsed as JSON with two-space indentation. The signature segment displays as raw text.
A Valid Format badge appears when decoding succeeds; Invalid Format when the token lacks three parts or JSON parsing fails. Load Sample fills a well-known HS256 example token. The UI notes that signature verification requires the issuer secret, which this tool never requests.
decodeJWT splits on dots, requires exactly three parts, decodes the first two with atob, and sets isValid true on success. Each section has its own copy button; Clear resets all fields.
How it works
You set code, css values, or structured text in the editor in the live panel. JWT Token Decoder then decode and parse JWT (JSON Web Token) headers, payloads, and signatures. Results show as formatted / generated code you can copy.
To encode or decode Base64 strings separately, use our Base64 Converter.
Usage scenarios
- Debug 401 after login: Paste the Bearer token from DevTools → Network. Confirm exp has not passed and aud/iss match what your API gateway expects before blaming CORS.
- Verify role claims in staging: Open a staging access token and check custom claims (role, tenantId, permissions) after a permission change — without calling a verify endpoint.
- Spot wrong algorithm assumptions: Read header.alg (HS256 vs RS256 vs none). Catch “alg=none” or unexpected kid values before you wire a mobile client to the wrong JWKS URL.
- Support ticket evidence: Decode a redacted customer token (strip PII claims first) and screenshot exp/iat for a ticket — still run decode locally so the raw JWT never hits a pastebin.
Input / Output Examples
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkRlbW8iLCJleHAiOjE3MzU2ODkwMDB9.signature
Output
Header: {"alg":"HS256","typ":"JWT"} · Payload: sub=1234, name=Demo, exp=1735689000 (readable UTC) · Signature: shown as opaque (not verified)Input
Expired access token from localStorage (three segments)
Output
Payload shows exp in the past → explains 401 Unauthorized; iat/nbf listed for clock-skew checks
Frequently Asked Questions
Does this JWT decoder verify the signature?+
No. Verification needs your secret or public key, which must never be pasted into a public page. FYN Tools only base64url-decodes the header and payload so you can inspect claims safely.
Is my JWT uploaded to a server?+
Decoding runs in your browser. The token is not stored in a FYN account. Still treat production tokens as sensitive — clear the field when you are done.
Why do I see “Invalid token” for a real JWT?+
Most failures are a missing segment, line breaks/spaces, or a truncated copy from logs. JWTs must be exactly three base64url parts separated by dots with no Bearer prefix.
How do I read the exp claim?+
exp is a Unix timestamp (seconds). Compare it to the current UTC time. If exp is in the past, APIs should reject the token even if the signature was once valid.
Can I decode encrypted JWTs (JWE)?+
This tool targets compact JWS tokens (header.payload.signature). Encrypted JWE strings need decryption keys and a different workflow — use your backend crypto stack instead.
Key Features
- Decode JWT button
- Load Sample token
- Valid Format / Invalid Format badge
- Header, payload, signature cards
- Per-section copy buttons
Benefits
See JWT claims without writing a decode script.
Speed up auth integration debugging.
Learn token structure hands-on from the sample.
When to Use JWT Token Decoder
- Debugging auth flows to see claims inside a returned token
- Checking exp or iat epoch values during session troubleshooting
- Learning JWT structure from the sample token
- Confirming which algorithm the header declares
Advantages
- Instant client-side decode
- Valid Format / Invalid Format badge
- Load Sample for immediate demo
- Separate copy buttons per section
Tips
- Valid Format does not mean the token is trustworthy — anyone can craft JWT-shaped strings.
- Avoid pasting production session tokens into shared machines.
- Check alg in the header before assuming HMAC versus RSA.
- Pair decode-only inspection with server-side verification in your app.
Common Mistakes
Treating Valid Format as proof of authenticity — signatures are never verified here.
Expecting the signing secret to appear in the decoded output.
Pasting tokens missing a segment and expecting partial JSON.
Sharing decoded payloads containing live user data without redaction.
Summary
Paste a JWT to decode header and payload JSON with a Valid Format badge — decode only, no signature verification.