UUID Studio

UUID Studio

JWT Decoder

Decode JSON Web Tokens without sending them to a server.

  • đź”’ No data stored or uploaded
  • ⚡ 100% client-side
  • 🆓 Free, no account
Click Convert when ready

Override only when Auto cannot parse your paste. Changing this loads a matching sample into Input — click Convert to run. Use Load sample to cycle every format example.

All conversions

Read-only representations of the same 16 bytes. Every textual form is listed here, not in “Prefer format”.

Paste two values: if both sides are valid JSON, a structural diff appears; otherwise UUID / bytes are compared when both decode to the same format.

A
B

Create or edit JSON here (syntax colors), then format, validate, or convert - same as MongoDB $binary UUID blobs on the Convert tab once detected.

New document

Hash, HMAC, AES-GCM/CBC + RSA-OAEP, codecs, JWT decoding, UUID v4, and secure random - all client-side. JWTs use Base64URL (three segments), not a single MIME Base64 block - use Decode JWT below, not raw Base64 decode.

Examples

  • Sample HS256 JWT 
    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

About JWT Decoder

A JWT looks like gibberish until you realize it's just three Base64URL segments glued together with dots: header, payload, signature. Once you know that, reading one is trivial - verifying it safely is not.

Paste a token and this decodes the header and payload back into readable JSON so you can inspect claims, expiry, and algorithm at a glance - no server round-trip, no account required.

Decoding is not the same as verifying. Anyone can read an unsigned JWT's contents; that's by design. Never trust a token's claims without checking its signature against your issuer's keys first, and treat production tokens with the same care as a password.

FAQ

Is it safe to paste production JWTs?
Processing is local, but anyone with screen access can read them. Prefer dev tokens; rotate secrets if exposed.
Why not use plain Base64 decode?
JWT uses Base64URL without padding. Use this decoder, not the MIME Base64 tool.