Decode a JWT and read its claims.

Paste a JWT to see its header and payload as formatted JSON. This tool reads claims — it does not check the signature.

JWT input

Result

Decoded claims

text
{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
}

Processed locally — inputs and results stay in this browser tab. Copy and download actions run only when you choose them.

More Signalbench tools

Small tools for stubborn bugs.

Format JSON, inspect JWT claims, explain cron expressions, and compare text locally in your browser.

Open

Format and validate JSON without leaving your browser.

Format, indent, and validate JSON locally in your browser, with a clear error message when the syntax is invalid.

Open

Understand any cron expression at a glance.

Parse a five-field cron expression and see the minute, hour, day, month, and weekday fields explained in plain language.

Open

Compare two texts line by line.

Compare two blocks of text line by line and see exactly which lines were added, removed, or unchanged, locally in your browser.

Open

Encode and decode Base64 without breaking Unicode.

Encode UTF-8 text as Base64 and Base64URL or decode canonical data back to Unicode text.

Open

Encode URL components without confusing + and %20.

Encode and decode UTF-8 URL components or HTML form values locally.

Open

Decoding is not verification

Base64URL-decoding the header and payload proves nothing about who issued the token or whether it was altered afterward. Checking the signature, issuer, audience, and expiry against a trusted policy is a separate step this tool does not perform.

  • Never paste a live production token into a shared result.
  • A decoded expiry claim still needs to be checked against the current time.
  • Signature verification needs the correct key and algorithm, not just the token.