Fydler UtilityBelt - JWT Decoder

JWT Decoder

Security & Authentication Tool

Encoded JWT Token

Header

---

Payload

---

Signature

Signature verification is not performed. This tool only decodes the data.

Security Note

This tool runs entirely in your browser. Your JWT tokens are never sent to our server. Decoding a JWT only shows the data it contains; it does not verify if the token is valid or trusted without the corresponding secret or public key.

lucide.createIcons(); const jwtInput = document.getElementById('jwt-input'); const jwtHeader = document.getElementById('jwt-header'); const jwtPayload = document.getElementById('jwt-payload'); const jwtError = document.getElementById('jwt-error'); const jwtErrorText = document.getElementById('jwt-error-text'); jwtInput.addEventListener('input', decodeJWT); function base64UrlDecode(str) { // Replace non-url compatible chars with base64 standard chars str = str.replace(/-/g, '+').replace(/_/g, '/'); // Pad out with standard base64 required characters const pad = str.length % 4; if (pad) { if (pad === 1) { throw new Error('InvalidLengthError: Input base64url string is the wrong length to determine padding'); } str += new Array(5 - pad).join('='); } return decodeURIComponent(atob(str).split('').map(function(c) { return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2); }).join('')); } function decodeJWT() { const token = jwtInput.value.trim(); if (!token) { jwtHeader.textContent = '---'; jwtPayload.textContent = '---'; jwtError.classList.add('hidden'); return; } const parts = token.split('.'); if (parts.length !== 3) { showError('Invalid JWT format. A JWT must have 3 parts separated by dots.'); return; } try { const header = JSON.parse(base64UrlDecode(parts[0])); const payload = JSON.parse(base64UrlDecode(parts[1])); jwtHeader.textContent = JSON.stringify(header, null, 2); jwtPayload.textContent = JSON.stringify(payload, null, 2); jwtError.classList.add('hidden'); } catch (err) { showError('Failed to decode JWT: ' + err.message); jwtHeader.textContent = '---'; jwtPayload.textContent = '---'; } } function showError(msg) { jwtErrorText.textContent = msg; jwtError.classList.remove('hidden'); }