Read a JWT header and payload as JSON. Inspect token claims during development without confusing decoding with verification.
How to use
Paste a token with three dot separated parts. Read the decoded header and payload, then verify claims through your application's trusted authentication flow.
Example
A payload containing sub and exp shows the subject and expiry claim. Seeing those fields does not prove that they are genuine.
FAQ
Does this verify a signature?
No. It checks neither authenticity nor authorization. Never accept a token just because it decodes, and avoid sharing live credentials.
Related tools
A practical task
Inspect only a token you are authorized to handle. A payload can contain personal information even when it is readable without a key. If an application rejects the token, check its trusted verification logs rather than treating a successful decode as proof that the application is wrong.
Another useful question
Can editing the payload fix access?
Changing data does not produce a valid trusted signature. Authorization belongs to the issuing and verifying systems, not to a text decoder.
Details for interpreting the result
| Detail | Explanation |
|---|---|
| Decoding and verification | Reading a token's fields only shows what its data claims. Verification checks the signature and the rules the application trusts. Expiry, issuer, audience, and authorization need their own checks after a token is parsed. |
| Standard and URL Base64 | JWTs use a URL friendly Base64 variant. Its alphabet differs from standard Base64 for two characters, and padding is often omitted. A token section and an ordinary Base64 string are not interchangeable without conversion. |
| Base64 size | Base64 normally stores three input bytes as four visible characters, with padding for incomplete final groups. Encoded text is therefore usually longer than its source bytes; it is not compression. |
| Base64 padding | An equals sign at the end of Base64 fills a final group. It is not part of the decoded message. Do not remove characters from the middle of the value to force a damaged string through a decoder. |
| Strict JSON syntax | JSON needs double quotes around keys and string values. Objects use braces and arrays use square brackets. Comments and trailing commas belong to other formats, so remove them before treating a source as JSON. |
| Strings and values | The JSON string "12" differs from the number 12, and "false" differs from false. Type changes affect comparisons and imports. Keep identifiers as strings when their leading zeros or exact digits matter. |