Private JWT decoder

JWT Decoder: Read a Token Locally

A compact JSON Web Token carries a header, payload, and signature. Paste one here to decode the first two parts as JSON and render the signature bytes as readable hex, all inside the browser parser.

jwt--jwtv1.0.0

Universalstring

Try the real parser

Paste input on the left. The same Rust parser that ships in the binary runs locally in this page and writes its JSON on the right.

browser · WebAssembly

Open text file

inputeditable

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

jc-rs --jwtJSON

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "iat": 1516239022,
    "name": "John Doe",
    "sub": "1234567890"
  },
  "signature": "49:f9:4a:c7:04:49:48:c7:8a:28:5d:90:4f:87:f0:a4:c7:89:7f:7e:8f:3a:4e:b2:25:5f:da:75:0b:2c:c3:97"
}

Hover over a JSON value, or focus the JSON pane and use the Left and Right arrow keys, to trace it to the input. Parsing runs inside this tab in WebAssembly. Pasted text and opened files are not uploaded. If site analytics is enabled, it may receive page-level visit data such as the URL, title, and referrer; text in this editor is never included.

Accepted input

A compact JWT with three dot-separated parts: an unpadded base64url header, an unpadded base64url payload, and a base64url signature. The first two parts must decode to valid UTF-8 JSON. Leading and trailing whitespace is ignored.

What the JSON contains

header contains the decoded JOSE header as a JSON value; fields such as alg, typ, and kid appear when the token carries them.
payload contains the decoded claims without evaluating or normalizing them.
signature is the decoded signature byte sequence rendered as lowercase, colon-delimited hex.
Invalid base64url, non-UTF-8 text, invalid JSON, or the wrong compact-token shape produces a parse error.

What you can do here

Decode a JWT token into header, payload, and signature data
Inspect compact-token structure with the JWT parser
Use the JWT decoder online; the token stays inside the browser parser
Read JWT claims without verifying or trusting them
Distinguish JWT parsing from signature validation

Use the same parser in a shell

$ printf '%s\n' "$JWT" | jc-rs --jwt

The browser tool is for inspection. The CLI form is the useful one in scripts, pipes, containers, and repeatable checks.

Continue with the parsed JSON

Filter decoded fields with jq →

Fixture coverage

noneThe reference corpus ships no oracle-valid fixture for this parser, so the differential cannot speak for it. That is reported, not hidden.

Magic syntax

not availableThis parser reads a file or a string rather than a command, so there is nothing for jc-rs to run. Pipe it in.

Source: crates/jc-rs-parsers/src/string/jwt.rs. jc-rs targets the schemas defined by the original Python tool. Fixture coverage above is the measured evidence for this parser; test the inputs your pipeline depends on. Compare