About JWT Decoder
Decodes a JSON Web Token without checking whether the provided secret / private key is valid. Use 'JWT Verify' to check if the signature is valid as well.
Input: text. Output: structured JSON.
Format reference: JWT Decode background and specification
Example
Use “Try example” to load this public sample and its settings, then run it.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTdHJpbmciOiJTb21lU3RyaW5nIiwiTnVtYmVyIjo0MiwiaWF0IjoxfQ.0ha6-j4FwvEIKPVZ-hf3S_R9Hy_UtXzq4dnedXcUrXk
Result
{
"String": "SomeString",
"Number": 42,
"iat": 1
}Decoding is not verification
A JWT payload can be read without its signing key. The displayed claims are untrusted until the signature, expected algorithm, issuer, audience and time claims have been checked by the receiving application.
What does this page return?
The tool returns the decoded payload. Use JWT Signature Verifier with the correct key for signature checking. That still does not replace your application’s authorization rules.
Parameters
This tool does not need additional parameters.
Before interpreting the result
Use the exact key encoding, mode, padding and IV expected by the source system. Historical ciphers are useful for learning and analysis. Encoding alone provides no confidentiality.
How to use this page
- Paste your input or open a local file.
- Adjust tool options if needed, then choose Run tool.
- Copy the result or download the original output bytes.
Inputs and results are not added to the public catalogue or saved in the URL. Processing happens in your browser; HTTP Request and DNS over HTTPS send the requests you explicitly run. Files up to 128 MiB can be opened; decompression and image tools may have smaller processing limits. Large results have a shortened preview. Text and HTML downloads use UTF-8; binary downloads preserve output bytes. Pasted text follows browser newline handling; open a file when exact input bytes matter.