PepsTools

Developer Tools

JWT Decoder

Decode a JSON Web Token header and payload. The signature is never reported as verified.

How to use it

Paste a token with two or three segments separated by dots. Decode shows the JSON header, the JSON payload, and the raw signature segment. The status line says the signature was not verified.

Example

The sample token decodes to a header and payload. signature_verified stays false.

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJlZGl0b3IifQ.not-a-verified-signature

Result

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "user_42",
    "name": "Ada Lovelace",
    "role": "editor"
  },
  "signature": "not-a-verified-signature",
  "signature_verified": false
}

How it works

Each segment is Base64URL. The first must be a JSON object. The second must be JSON. The third segment is displayed and not checked against a secret or public key. An alg of none is called out as unauthenticated.

Common errors

  • The header is not an object The first segment decoded, but it was not a JSON object.
  • There are not two or three segments A compact JWT uses dots as separators. Extra dots usually mean the token was truncated or pasted twice.
  • You expected Valid This page does not say a token is valid. Checking a signature needs a key and is a different operation.

Limitations

Expiration, issuer, and audience claims are displayed when present. They are not treated as a pass or fail. The decoder does not store the token.

Privacy

The token is decoded locally. Do not paste a live access token if your device is shared. PepsTools does not send the token to a server.

Questions

Can I use the result to authorize a request?

No. Authorization needs a verified signature and claim checks. This tool only decodes.