JWT Decoder

Decode a JWT's header and payload from base64url JSON and report the signature bytes; the signature is never verified, so status is always unverified.

Description

Decode JWT header and payload JSON and expose signature bytes without verifying trust.

JWT Decoder decode JWT header and payload JSON and expose signature bytes without verifying trust.

Use this for debugging token structure, inspecting claims, and checking timestamps or identifiers before performing verification in an authentication library.

When to use JWT Decoder

Use this for debugging token structure, inspecting claims, and checking timestamps or identifiers before performing verification in an authentication library.

How it works

The tool requires three compact-serialization segments, base64url-decodes the header and payload as UTF-8 JSON objects, and renders the signature bytes as hex.^[1]

Interpreting the result

Keep the input units, direction conventions, encoding, and ordering rules visible when reusing the result. Preserve the full returned value for downstream calculations and round only for presentation.

Assumptions and limitations

Decoding is not verification. A readable token can be expired, forged, intended for another audience, or use an unacceptable algorithm; never authorize access from this output alone.

References

RFC 7519: JSON Web Token (JWT) — RFC Editor