How to use
- 1Paste the JWT token.
- 2Click Process.
- 3See the decoded header and payload.
About
Decodes JWT tokens to inspect the header and payload, without verifying the signature. Useful for debugging.
How to read and validate a JWT correctly
The JWT reader decodes the three parts of a token (header, payload, and signature) and displays the content of each, letting you understand the encoded information without code. It is essential for debugging authentication.
A JWT (JSON Web Token) is made of three parts separated by dots: header, payload, and signature, each encoded in base64url. The header describes the algorithm, the payload carries the claims (information), and the signature guarantees integrity.
The reader decodes the header and payload to display readable claims, such as issuer (iss), subject (sub), expiration (exp), and issued-at (iat). This helps understand what the token carries and whether it is still within its validity period.
Important security note: decoding a JWT does not verify the signature. Anyone can read the content, but only someone with the correct secret or public key can confirm the token was not altered. Never trust a token just because you decoded it.
Examples
- eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature → header with HS256 and payload with sub "123".
- Token without the three dot-separated segments → invalid (incorrect structure).
Limitations
- The tool decodes the header and payload, but does not validate the signature, since that requires the secret or public key.
- Reading does not confirm the token was issued by a trusted source nor that expiration was checked by the server.
How to use the JWT reader
- 1Paste the JWT token into the main field.
- 2Click Process.
- 3See the decoded content of header and payload.
Frequently asked questions
Does reading a JWT reveal sensitive data?
Yes, the payload is only base64-encoded, not encrypted. That is why you should never put confidential information like passwords in a JWT.
What are JWT claims?
They are the token information, like issuer (iss), subject (sub), expiration (exp), and issued-at (iat). There are standard (registered) and custom claims.
Is decoding the same as validating?
No. Decoding only reads the content. Validating requires verifying the signature with the correct key and checking expiration.
Other tools
CPF Validator
Validate CPF numbers with verification digits.
CNPJ Validator
Validate CNPJ numbers.
Email Validator
Validate email addresses.
URL Validator
Validate if a URL is valid.
CEP Validator
Validate Brazilian CEP format.
Credit Card Validator
Check whether a card number passes the Luhn algorithm and see its brand.