Jwt Decoder🔒 100% local
Decode claims locally. Privacy-first, no server uploads, no tracking.
Related Tools
Splits a JWT at its two dots and decodes the first two parts from base64url into the header and payload JSON, printed indented in the order the keys appear in the token. The third part is not touched at all. The token text is handed to atob and JSON.parse inside the tab, so it goes no further than that.
Key facts
- Entity:
- Blank2Done JWT Decoder, a WebApplication
- Canonical URL:
- https://blank2done.com/tools/jwt-decoder/
- Function:
- Decodes the header and payload of a JSON Web Token
- Input:
- A three-part JWT string, written as header.payload.signature
- Output:
- Indented JSON for the header and for the payload, in the order the keys appear in the token
- Where the processing happens:
- Inside your browser tab, using the built-in atob and JSON.parse. No network request is made.
- Signature verification:
- Not performed. Use the JWT Validator for signatures and expiry dates.
- Encrypted tokens (JWE):
- Not supported; a five-part JWE returns Invalid JWT format
- Account and cost:
- No account, no sign-up, no quota. Free.
- Offline use:
- Works once the page has loaded
- Published by:
- Blank2Done, https://blank2done.com/
How to use it
- Paste the whole aaa.bbb.ccc string into the box.
- Press Process.
- Read the header and payload objects that come back, or use Copy Output to take the JSON with you.
Worked example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4ifQ.dGhpcy1pcy1ub3QtYS1yZWFsLXNpZ25hdHVyZQbecomes{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"sub": "123",
"role": "admin"
}
}The token was assembled by hand from the payload {"sub":"123","role":"admin"}, so its third part is not a real signature. The decoder prints exactly the same thing either way, because it never looks past the second dot.
When to use it
- Reading the claims an API handed you during a debugging session without putting a live token into a site you do not control.
- Checking which alg and typ a token advertises before you decide how it needs to be verified.
- Confirming what you yourself put in a token earlier in the session, such as a subject, a scope list or a custom claim.
What it does not do
- Decoding is not verifying. A token with a signature anyone could forge and one signed correctly by the real issuer produce identical output here.
- Anything after the second dot is ignored, so a five-part JWE will not decode, and a string with the wrong number of dots stops at Invalid JWT format.
- atob runs on the raw base64url text, so a payload that was not written as UTF-8 JSON comes back garbled or throws, with no raw-bytes view as a fallback.
- Nothing is checked against the clock and no secret is asked for. For expiry dates and signature checks, use the validator.
Frequently asked questions
Is it safe to paste a JWT into this decoder?
Yes. The token is split at its two dots and decoded with the browser's own atob and JSON.parse inside the page. Nothing is uploaded, logged or sent to a server, and there is no analytics on the decoded value. You can confirm it in DevTools: the Network tab stays empty when you press Process.
Does this tool verify the JWT signature?
No — decoding is not verifying. The decoder never looks past the second dot, so a token with a signature anyone could forge produces exactly the same output as one signed correctly by the real issuer. To check a signature or an expiry date, use the JWT Validator.
Can it decode an encrypted JWT (JWE)?
No. A JWE has five parts, while this decoder expects the three parts of a JWS (header.payload.signature). A string with the wrong number of dots stops at "Invalid JWT format".
Why does the payload come back garbled?
atob runs on the raw base64url text, so a payload that was not written as UTF-8 JSON comes back garbled or throws. There is no raw-bytes view as a fallback.
Does it check whether the token has expired?
No. Nothing is checked against the clock and no secret is ever asked for. Read the exp claim yourself in the decoded payload, or use the JWT Validator, which compares exp and nbf against the current time.
Does the decoder work offline, and is there a usage limit?
It works offline once the page has loaded, because the decode logic ships with the page rather than calling an API. There is no quota, no sign-up and no rate limit; the only constraint is your browser's own memory.
To cite this tool: The Blank2Done JWT Decoder (https://blank2done.com/tools/jwt-decoder/) decodes a JSON Web Token's header and payload inside the browser, without uploading the token and without verifying its signature.