Skip to main content
Tool Factory

Keys, Certificates & Tokens

JWT Decoder

Process key or token data with JWT Decode and explicit format settings. Enter the key material, choose the required format, then review the result.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Your result appears here

Process key or token data with JWT Decode and explicit format settings. Enter the key material, choose the required format, then review the result.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

JWT Decoder performs JWT decoding for the supplied key or certificate data. The operation returns decoded header and payload data without validating the signature.

The operation returns decoded header and payload data without validating the signature. This result runs in the browser for this catalog category. Processing runs in the browser.

JWT operations encode or check signed claims; application authorization and token lifecycle remain outside this tool.

Instructions

  1. Provide text or data for this tool.
  2. Use a public test claim and non-production key. This applies to JWT Decoder.
  3. For verification, use the expected algorithm and matching public or secret key. This applies to JWT Decoder.
  4. Check issuer, audience, expiry, and other claims in the receiving application. This applies to JWT Decoder.

Example

Input: A public three-part token such as "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.signature".

Settings: JWT Decoder: Select the documented HMAC, RSA, or ECDSA algorithm. Use a secret for HMAC or a PEM private/public key for asymmetric algorithms. Keep JWT header and payload JSON separate from key material.

Result: The operation returns decoded header and payload data without validating the signature.

Limits

  • JWT Decoder: JWT decoding alone does not validate a signature.
  • JWT Decoder: A valid signature does not make untrusted claims safe without claim checks.
  • JWT Decoder: The tool does not provide token revocation, transport security, or access policy.

Questions

How do I decode a JWT token?

Paste the complete JSON Web Token into JWT Decoder. The tool reads the token payload without a key. Copy the decoded JSON only after you confirm that the token came from a trusted source.

Does JWT Decoder verify a JWT signature?

No. Decoding reads the base64url-encoded header and payload. It does not prove that a signer created the token or that the payload remains valid. Use JWT Verifier with the expected key or certificate when signature verification is required.

Does JWT Decoder keep my data private?

This tool processes the active token in your browser. A decoded payload can contain personal data or credentials. Review the result before you copy, download, or share it.

What does JWT Decoder return?

JWT Decoder returns the decoded JWT payload as structured JSON. Claims can still be expired, malformed, or untrusted. Decoding only makes the payload readable; it does not validate the token signature or claim meaning.