What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Yes. You can inspect a typical signed JSON Web Token (JWT) entirely on your device: split its compact form at the periods, Base64URL-decode the header and payload, convert the bytes to UTF-8, and parse the result as JSON. This reveals what the token contains, but it does not prove that the token is authentic, current, or authorized for anything.
What decoding a JWT does—and does not do
A JWT is a compact representation of claims. In the common signed form, called a JSON Web Signature (JWS), the token has three period-separated parts: a JOSE header, a payload containing claims, and a signature. The first two parts are encoded rather than encrypted, so anyone who possesses the token can read them. No backend request or signing key is needed for that inspection.
As an Amazon Associate I earn from qualifying purchases.
Decoding is only an encoding operation. It does not check the signature, identify a trusted issuer, check expiration, or establish that a claim such as admin or role should control access. Those are verification and validation tasks that belong in the application or another trusted security component.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Operation | What it answers | Key or trust required? |
|---|---|---|
| Decode | What bytes and JSON are represented by the visible token parts? | No signing key |
| Signature verification | Was the signed content produced with the expected key and left unaltered? | Yes: the appropriate public key or shared secret |
| Validation | Does the verified token meet this application’s issuer, audience, time, and algorithm rules? | Yes, plus application policy |
RFC 7519 describes validation as a sequence of required checks and states: “If any of the listed steps fail, then the JWT MUST be rejected — that is, treated by the application as an invalid input.” Read the standard at RFC 7519.
#1 Best Overall
Know which JWT serialization you have
Do not assume every JWT has three parts. The period count depends on the compact serialization and whether the content is signed or encrypted.
| Form | Compact parts | What is visible without keys? | Can simple decoding reveal claims? |
|---|---|---|---|
| Compact JWS | 3 | Header, payload, signature bytes | Yes. Decode the first and second parts. |
| Compact JWE | 5 | Protected header, encrypted key, initialization vector, ciphertext, authentication tag | No. The ciphertext must be decrypted with the proper key and algorithms. |
| Nested JWT | Depends on the outer and inner objects | May contain a JWS or JWE inside another object | Inspect each layer according to its type. |
JWE claims are encrypted. Base64URL-decoding its visible segments only turns encoded bytes into readable representations; it does not decrypt the claims. A five-part token therefore needs a decryption key and a compatible implementation, not merely a different text decoder. The format definitions and processing rules are covered in RFC 7519.
Protect the token before you inspect it
JWTs are often bearer credentials: possession can be enough for a service to accept a request. Treat a production token as sensitive even when your immediate goal is only to read it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Prefer a decoder that runs locally in your browser or on an offline workstation for live credentials.
- Do not paste a production token into a website, chat, issue tracker, screenshot, or shared terminal transcript unless disclosure is explicitly acceptable.
- Use a deliberately fabricated or revoked token when demonstrating a workflow.
- Remember that signed JWT contents are readable. Never put passwords, private keys, API secrets, or other confidential data in an unencrypted header or payload.
The JWT introduction at jwt.io explains that signing protects integrity but does not hide the claims. Its page also offers an online debugger that can decode, verify, and generate JWTs. An online tool is convenient for non-sensitive examples; the data-handling practices of a particular debugger should be checked separately rather than assumed.
Manual decoding without a backend
You can decode a compact JWS with any implementation that correctly handles Base64URL and UTF-8. The procedure is:
- Obtain the token as one string. Remove surrounding whitespace, but do not edit characters inside the token.
- Split on the period character. A normal compact JWS produces three segments: encoded header, encoded payload, and encoded signature.
- Decode the first two segments as Base64URL. Base64URL uses
-and_instead of+and/. Padding characters may be omitted, so a decoder must restore the required padding before using a conventional Base64 routine. - Interpret the resulting bytes as UTF-8. Converting bytes directly as Latin-1 can corrupt names, emoji, and other non-ASCII claim values.
- Parse the UTF-8 text as JSON. A valid JWS payload is expected to contain a JSON claims set. Parsing success still says nothing about the signature or trustworthiness.
The signature is not needed to display the header and payload. Keep it intact if you later perform verification, because verification covers the encoded header and payload together with that signature.
A robust browser-only decoder
The following code uses browser APIs only. It validates the Base64URL alphabet, restores omitted padding, decodes bytes with atob, converts them with a fatal UTF-8 TextDecoder, and reports malformed input instead of silently producing misleading text.
function decodeBase64UrlUtf8(segment) {
if (typeof segment !== 'string' || !/^[A-Za-z0-9_-]*$/.test(segment)) {
throw new Error('Invalid Base64URL segment');
}
const base64 = segment
.replace(/-/g, '+')
.replace(/_/g, '/')
+ '='.repeat((4 - (segment.length % 4)) % 4);
let binary;
try {
binary = atob(base64);
} catch {
throw new Error('Segment is not valid Base64URL');
}
const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));
try {
return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
} catch {
throw new Error('Segment is not valid UTF-8');
}
}
function decodeJwtForInspection(token) {
if (typeof token !== 'string' || token.trim() === '') {
throw new Error('Provide a non-empty token string');
}
const parts = token.trim().split('.');
if (parts.length === 5) {
return {
kind: 'JWE',
message: 'This is a five-part compact JWE. Its claims are encrypted and cannot be read by Base64URL-decoding alone.'
};
}
if (parts.length !== 3) {
throw new Error(`Expected a three-part JWS or five-part JWE; received ${parts.length} parts`);
}
let headerText;
let payloadText;
try {
headerText = decodeBase64UrlUtf8(parts[0]);
payloadText = decodeBase64UrlUtf8(parts[1]);
} catch (error) {
throw new Error(`Cannot decode token: ${error.message}`);
}
let header;
let payload;
try {
header = JSON.parse(headerText);
payload = JSON.parse(payloadText);
} catch {
throw new Error('Header or payload is not valid JSON');
}
if (!header || typeof header !== 'object' || Array.isArray(header)) {
throw new Error('JOSE header is not a JSON object');
}
if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
throw new Error('JWT payload is not a JSON claims object');
}
return {
kind: 'JWS',
header,
payload,
encodedSignature: parts[2]
};
}Run it locally
- Open a blank browser tab, open Developer Tools, and select the Console, or save the function in a local HTML file that contains no network calls.
- Paste the function definitions into the console.
- Store the token in a local variable without logging it to a shared console history. For an interactive prompt, use
const token = window.prompt('Paste JWT for local inspection');. - Call
decodeJwtForInspection(token). For a three-part JWS, the returned object contains parsedheaderandpayloadobjects plus the untouched encoded signature. For a five-part JWE, it explains why the claims are not available.
Do not replace the UTF-8 conversion with a bare JSON.parse(atob(parts[1])). That shortcut fails for unpadded Base64URL and can misread Unicode because atob returns binary characters rather than decoded UTF-8 text.
Rank #3
Read the decoded header and claims correctly
Header fields
The JOSE header commonly includes alg, which names the cryptographic algorithm, and typ, which may identify the object as a JWT. A key identifier such as kid can help a verifier select a key. These values describe how a token says it should be processed; they are not, by themselves, proof that the application should accept that processing choice.
Registered and application claims
Claims are JSON members. Common registered names have conventional meanings, but your application must still apply its own policy.
| Claim | Typical meaning | What inspection alone cannot establish |
|---|---|---|
iss |
Issuer identifier | That the named issuer actually created this token |
sub |
Subject identifier | That the subject is authenticated for this request |
aud |
Intended audience | That your service is an allowed audience |
exp |
Expiration time, normally a NumericDate | That the clock check was performed or that the token was signed by a trusted party |
nbf |
Not-before time | That the current time satisfies the policy |
iat |
Issued-at time | That the stated issuance event occurred |
jti |
Token identifier | That it has not been revoked or replayed |
Custom fields such as role, scope, or admin are ordinary input until a trusted validation path accepts them. A browser that merely displays those values must never use them as the sole basis for authorization.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →When decoding is not enough: verification and validation
If a token will influence access, a trusted component must verify its signature or MAC using the expected key and an explicitly permitted algorithm. It must then validate the claims against application policy.
- Choose the allowed algorithm set in configuration. Do not let an untrusted
algheader decide which algorithms your verifier enables. - Obtain the correct verification key. Depending on the deployment, this may be a configured shared secret or the issuer’s expected public key. A key identifier is a lookup hint, not a key.
- Verify the exact signed content. The verifier checks the encoded header and payload together with the signature. A decoded-and-re-serialized JSON object is not necessarily byte-for-byte identical.
- Validate issuer and audience. Compare
issandaudwith values configured for this service, not merely with strings supplied by the token. - Validate time claims and local clock policy. Apply the required checks for
expandnbf, with any narrowly defined clock-skew allowance. - Apply application rules. Check scopes, subject status, token type, revocation strategy, and any other conditions required by the endpoint.
- Reject on failure. Do not fall back to decoded values when verification or a required validation step fails.
The distinction between signature verification, issuer checking, and broader validation is explained in the JWT introduction and specified in RFC 7519. A local decoder is suitable for display and debugging; it is not an authorization engine.
Local decoder or online debugger?
Both approaches can expose a JWS payload, but they have different operational consequences.
| Question | Local code | Online debugger |
|---|---|---|
| Does the token leave your device? | Not when the code is self-contained and no network request is made. | It may be transmitted to the service; review that service’s handling before using sensitive data. |
| What can it do? | Exactly what you implement: decoding, parsing, and optional local checks. | The jwt.io debugger can decode, verify, and generate JWTs. |
| Base64URL and UTF-8 behavior | Under your control; use padding restoration and byte-aware UTF-8 conversion. | Depends on the tool’s implementation. |
| JWS, JWE, or nested support | You must deliberately implement the required serialization and cryptography. | Support varies; a visible five-part JWE still requires decryption keys. |
| Best use | Production credentials, repeatable debugging, and privacy-sensitive work. | Safe sample tokens, quick demonstrations, and interactive verification experiments. |
Using an online debugger does not turn decoding into trust validation. It only changes where the inspection takes place and may add verification features.
Troubleshoot common decoding failures
“Expected three parts”
Count the segments separated by periods. Five indicates compact JWE, while a different count can mean a malformed string, a non-compact serialization, or an outer wrapper. Do not delete periods to force a three-part result; that changes the signed data.
Invalid Base64URL or padding errors
Check for copied line breaks, quotation marks, spaces, URL escaping, or characters outside A-Z, a-z, 0-9, -, and _. Unpadded input is normal, so the decoder must add zero, two, or three = characters according to the segment length modulo four. A segment whose length modulo four is one cannot represent valid Base64 data.
Unreadable characters
The decoded bytes may be valid UTF-8 even when they are not valid Latin-1 text. Convert the byte array with a UTF-8 decoder before parsing JSON. A fatal UTF-8 error indicates corrupted or non-UTF-8 content rather than a reason to substitute arbitrary characters.
JSON parse errors
Successful Base64URL decoding does not guarantee JSON. Verify that you decoded the first and second segments, not the signature, and that the token was not truncated or wrapped in an additional encoding. A claims payload should be a JSON object for normal JWT processing.
The payload is readable but the token is rejected
That is expected when inspection is separated from validation. The signature may be invalid, the issuer or audience may not match, the token may be outside its valid time window, or the service may reject the configured algorithm or another application rule. Use the verifier’s diagnostic output rather than treating visible claims as evidence of acceptance.
The token has five parts and no claims appear
You are likely looking at compact JWE. The ciphertext is intentionally unreadable without the decryption key and compatible algorithms. Base64URL conversion can show the protected header and other encoded fields, but it cannot recover the claims.
Nested and non-compact cases
JWT structures can be nested: an encrypted object can contain a signed JWT, or a signed object can carry another JWT as its payload. Decode only the layer whose type you have identified, then process the inner layer according to its own serialization. A period count is a useful first diagnostic, not a complete parser for every JOSE representation.
JSON Web Tokens can also appear in JSON serialization rather than the compact period-separated form. A compact-token splitter is not appropriate for that representation. If an upstream protocol wraps the token in JSON, extract the exact serialized value first and preserve its bytes for any later verification.
Quick Recap
Safe-use checklist
- Inspect sensitive tokens locally whenever possible.
- Expect three parts for a common compact JWS and five for compact JWE; treat other counts as a signal to investigate.
- Restore Base64URL padding and decode bytes as UTF-8 before parsing JSON.
- Keep the original encoded header and payload unchanged if verification will follow.
- Never treat decoded roles, scopes, subjects, or administrator flags as authorization proof.
- Configure acceptable algorithms, expected issuer, audience, and time rules explicitly in the trusted verifier.
- Reject a token when any required verification or validation step fails.
- Do not place secrets in unencrypted JWT headers or payloads.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
