How to decode a JWT safely

The three parts of a compact JWT

A common signed JWT contains three dot-separated parts: header, payload, and signature. The first two parts are Base64url-encoded JSON. The signature is binary data represented with Base64url.

Decoding the first two parts is a representation change. Verification requires the correct algorithm, key, and security checks.

How to decode a JWT

1. Copy the complete three-part compact token.
2. Paste it into the decoder and select Decode JWT.
3. Read the header, especially the declared algorithm and key identifier.
4. Inspect the payload claims as untrusted data.
5. Use a trusted JWT library in the application to verify the signature and validate claims.

The ToolPixels decoder supports UTF-8 JSON objects in three-part tokens. It does not support five-part encrypted JWTs.

Common JWT claims

Time claims are usually NumericDate values in Unix seconds. A decoder may display them, but the application must enforce them with an appropriate clock policy.

Decoding is not verification

Anyone can construct a header and payload that say they are an administrator. Without signature verification, those claims have no authenticated source. The declared algorithm must also be restricted by application configuration rather than trusted from the token alone.

Issuer, audience, expiration, not-before time, token type, and application-specific claims need explicit validation after the cryptographic check succeeds.

Handle JWTs carefully

• Tokens may contain personal data or active credentials.
• Do not paste production tokens into logs, tickets, or public messages.
• Do not use decoded output alone for authentication or authorization.
• Remember that JavaScript number precision can affect very large JSON numbers.
• Use short-lived test tokens when diagnosing integrations.

Try it with ToolPixels

Decode the header and payload of a three-part JWT locally for inspection, with clear warnings that no signature or claim is verified.

Decode a JWT