b2KIT

JWT Decoder

Decode and inspect JSON Web Tokens to view header, payload, and signature claims.

How to Use JWT Decoder

  1. 1

    Paste your JWT

    Enter the JSON Web Token string you want to inspect.

  2. 2

    View the payload

    See the decoded header, payload, claims, and expiration time.

  3. 3

    Verify the token

    Check if the token is expired or has valid structure.

Tested tool guide Developer and data tools Checked July 30, 2026

What JWT Decoder does, with a checked example

A JSON Web Token normally contains three dot-separated Base64URL segments: header, payload, and signature. This decoder displays the JSON in the first two segments and interprets common time claims. Decoding is useful for inspection, but it does not prove who issued the token or whether its signature is valid.

Worked example

A concrete input and expected output from the current implementation.

Input

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJiZWUyIiwiaWF0IjoxNzAwMDAwMDAwfQ.

Expected output

Header: {"alg":"none","typ":"JWT"}
Payload: {"sub":"bee2","iat":1700000000}

The two JSON segments decode without a secret. The empty third segment and alg value none mean this example carries no cryptographic signature and must never be trusted for authorization.

How the result is produced

1

Base64URL is decoded locally

Hyphen and underscore are translated to the standard Base64 alphabet, missing padding is restored, and the resulting UTF-8 text is parsed as JSON.

2

Claims are data until verified

Fields such as sub, exp, nbf, iss, and aud describe identity and validity constraints. An application must verify the signature, allowed algorithm, issuer, audience, and time claims before relying on them.

Good uses

  • Inspect a development token while debugging authentication.
  • Confirm whether exp and iat values use Unix seconds.
  • Compare expected issuer or audience values with received claims.

Limits and checks

  • Never paste a live bearer token into a device you do not control.
  • The displayed expiration status depends on the local clock.
  • A readable payload can still belong to a forged or modified token.

Common questions

Does decoding verify the signature?

No. Signature verification requires the expected algorithm and an appropriate key. This page only decodes and presents the token segments.

Why can anyone read a JWT payload?

Standard signed JWTs provide integrity, not confidentiality. Encrypt sensitive claims with an appropriate JWE design or keep them out of browser-visible tokens.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

JSON Formatter & Validator

Format, validate, and beautify JSON with syntax highlighting and error detection.

Base64 Encoder / Decoder

Encode text or files to Base64 and decode Base64 strings back to their original form.

SQL Formatter & Beautifier

Format and indent SQL queries for better readability across all major dialects.

HTML to Markdown Converter

Convert HTML markup into clean Markdown syntax with support for tables and lists.

Markdown to HTML Live Preview

Write Markdown and see the rendered HTML output in real time with live preview.

Diff / Patch Viewer

Visualize unified diffs and patch files with color-coded additions and deletions.