JWT decoder
Paste a JSON Web Token (three base64url segments: header, payload, signature). We decode the header and payload as JSON and show the signature segment for reference. Everything runs in your browser — your token is not uploaded. We do not verify signatures; use your auth stack for that.
Tip: Ctrl+Enter (Windows) or Cmd+Enter (Mac) decodes.
Header
Payload
Signature (not verified)
This is the raw third segment. Proving the token was issued by a trusted party requires cryptographic verification with the correct secret or public key — not implemented on this page.
Decoded. If you are checking tokens from OAuth, Stripe webhooks, or your own API gateway, CloudyBot can poll endpoints, parse JSON, and alert you when claims or status change — on a schedule, with memory and optional browser automation.
Try CloudyBot FreeFree plan · No credit card · 60-second setup
How it works
A JWT (JSON Web Token, RFC 7519) is usually a single string with two dot separators, yielding three segments. The first segment is the header: a small JSON object (typically alg and typ) encoded with base64url. The second is the payload (the “claims”): JSON like sub, iss, exp, custom app fields — also base64url-encoded. The third segment is the signature: binary data, base64url-encoded, produced with a secret or private key depending on the algorithm.
This page uses your browser’s atob plus a UTF-8 decoder to turn each segment from base64url into bytes, then text, then JSON.parse for header and payload so you can read them with indentation. That is decoding, not verification. A forged token can still contain a perfectly readable payload; only signature verification with the issuer’s keys proves integrity. We deliberately do not attempt HS256/RS256/JWKS verification here — that belongs in your API gateway, backend middleware, or identity provider.
Because decoding happens locally, you can inspect staging or sample tokens without sending them to CloudyBot. Follow your company policy: production access tokens and refresh tokens may still be sensitive even if they never leave the browser on this page.
Common use cases
- Debug OAuth / OpenID Connect — read
aud,scope,exp, and custom claims from an access token during integration. - Inspect API gateway JWTs — confirm which issuer and algorithm a Kong, AWS API Gateway, or Auth0-issued token advertises in the header.
- Compare clock skew — when
expornbflook wrong, decode and read numeric timestamps (we also show UTC hints when those claims are standard Unix seconds). - Teach JWT structure — show students or teammates that the payload is only encoded, not secret.
- Sanity-check webhook samples — decode a copied JWT from logs to see the JSON body before writing validation code.
- Pair with your JSON workflow — after decoding, use our JSON formatter on exported claim objects if you paste them separately.
You just decoded a JWT. CloudyBot can watch the APIs that mint them.
Example: “Call our token endpoint every hour, decode the JSON body, and Slack me if expires_in drops below five minutes.” CloudyBot combines scheduled tasks, HTTP-style automation, and memory — so you are not manually decoding in a tab forever.
Free plan · No credit card · 60-second setup
Online JWT decoder for developers
People search for a JWT decoder, JWT parser, or decode JWT online when they need to read header and claim JSON quickly. This tool focuses on clarity and privacy: local decoding, explicit “signature not verified” messaging, and optional UTC hints for common time claims. If you outgrow one-off pastes, CloudyBot can automate the surrounding workflow — scheduled checks, notifications, and browser-backed steps — with predictable caps on usage.
Frequently asked questions
Is this JWT decoder free?
Yes. There is no signup, no usage counter, and no paywall. Use it as often as you like.
Is my JWT sent to your servers?
No. Decoding runs entirely in your browser. Open DevTools, Network tab, and decode a token — you will not see your paste sent to CloudyBot.
Does this verify the JWT signature?
No. This tool only base64url-decodes the header and payload and shows the signature segment as text. Cryptographic verification (HS256, RS256, JWKS, etc.) is not performed and cannot prove a token is authentic.
Why can I read the payload without verifying the signature?
JWT payloads are only base64url-encoded, not encrypted. Anyone with the token string can decode the payload. Integrity and authenticity require verifying the signature with the issuer's secret or public key — which this page does not do.
Can I decode very large JWT strings or OAuth access tokens?
Yes, within what your browser can handle. Very long tokens may slow the tab; decoding still runs locally and is not uploaded. For cryptographic verification, use your identity provider or server-side middleware.
What is CloudyBot?
CloudyBot is a hosted AI agent that can browse the web, use files, remember context across conversations, and run tasks on a schedule — with hard billing caps so you never get surprise overages. This decoder is a small, trustworthy utility; the product is for when you want the machine to do the repetitive work instead of watching you paste tokens.
Related tools
More utilities on the hub; format JSON from claim bodies with our formatter:
Try CloudyBot on the free plan
30 AI Tasks / month · 2 browser sessions (10 min) · 50 MB storage · 7-day chat history
Start free — no credit card