JWT Decoder
Reads a JSON Web Token in the browser. Paste a compact token with three segments (header.payload.signature). The page base64url-decodes the header and payload and pretty-prints the JSON. It does not verify signatures, does not fetch JWKS, and does not send the token to a server.
JWT decoder
Decode only. Signatures are not verified. The token never leaves the browser. This is not a security audit.
How to use
- Paste a JWT with three segments: header.payload.signature.
- Read the pretty-printed header JSON and payload JSON.
- The signature is ignored. Nothing is sent to a server. This page does not verify, encode, or sign.
Results
Paste a JWT to decode the header and payload.
Runs in your browser. Nothing is uploaded.
Frequently asked questions
What is a JWT?
A JWT is a JSON Web Token. It has three segments separated by dots: header, payload, and signature. This JWT decoder reads the header and payload in your browser. It does not verify the signature.
What is the difference between decode and verify?
Decode reads the header and payload JSON. Verify checks the signature with a key. This page is decode only. It does not verify signatures, does not fetch JWKS, and is not a security audit.
Is my token sent to a server?
No. Decode runs in your browser. The token never leaves the browser. There is no signup, and Tallymill does not save what you paste. Refreshing the page clears the form.
Why does this JWT decoder require three segments?
A compact JWT is header.payload.signature. This page requires exactly three non-empty segments after trimming. Two-part unsigned tokens (header.payload with no signature) are rejected.
How does base64url decoding work on this page?
The header and payload are base64url-decoded, then parsed as UTF-8 JSON and pretty-printed. The signature segment is present and ignored. Invalid base64url or non-JSON content fails closed with an error. Tokens larger than 100KB are rejected.
Is this a security audit?
No. This is not a security audit, not a verifier, and not a signing tool. Signatures are not checked. Do not treat a decoded token as trusted. Confirm tokens with your own keys and tools.
Do I need an account? Does this run on the server?
No. The JWT decoder is client-side only. There is no signup. Nothing you paste is sent to a server. Refreshing the page clears the token.