JWT Decoder
A JSON Web Token (JWT) consists of three dot-separated parts — header.payload.signature — each individually Base64url-encoded. This tool splits a pasted token on those dots, decodes the header and payload, and displays both as neatly indented JSON. Everything happens entirely client-side in your browser: nothing is sent to our server, nothing is logged, and nothing is stored. Important to know: this tool only decodes — it does NOT check whether the signature is valid. Base64url-decoding tells you what's inside a token, not whether it was issued unchanged by a party you trust. Verifying that requires the secret or public key material, which should never live in a browser.
What people use this for
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHeader → { "alg": "HS256", "typ": "JWT" }Payload → { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
What others think of this tool
No reviews for this tool yet. Yours would be the first.
Do you work with Westcube?
Leave a review on Google tooFrequently asked questions
Does this tool verify whether the token is valid?
No, and it can't from a browser. This tool only decodes the header and payload — they're merely Base64url-encoded, not encrypted, so anyone can read them without any key. Whether the signature is correct (meaning the token was actually issued by the expected party and hasn't been tampered with) can only be established with the issuer's secret or public key material. That material must always stay server-side and should never end up in a client-side tool like this one. So never treat a decoded token as 'verified' — for real verification, use a JWT library on your server with the correct secret or public key.
Why does JWT use Base64url instead of regular Base64?
A JWT is often passed in a URL, an HTTP header, or a cookie, where regular Base64's '+', '/' and the '=' padding character can cause problems (they have special meaning in URLs, or sometimes get truncated). Base64url replaces '+' with '-' and '/' with '_', and drops padding entirely. This tool automatically converts that back to standard Base64 before decoding — so just paste the full token exactly as you received it.
What if I get an error message when pasting my token?
First check that you pasted the ENTIRE string, including both dots separating the three parts — a truncated token is the most common cause. If the error persists, the pasted token likely doesn't contain three parts, or one of the parts doesn't decode into valid JSON (for example because you accidentally pasted only the payload, or extra whitespace got included).
Are my tokens stored or sent anywhere?
No. Decoding happens entirely locally in your browser using the built-in atob() function. Nothing is sent to any Westcube server (or anyone else's), nothing is logged, and nothing is retained. Feel free to paste a real token to inspect it — just keep in mind that a JWT's payload (such as a user ID or email address) is readable by anyone who gets hold of the token, so never share production tokens lightly.