JWT Token Decoder & Inspector

What does the JWT Token Decoder & Inspector do?

The JWT Token Decoder & Inspector parses Base64URL-encoded JSON Web Tokens (JWT) into structured JSON objects. It extracts and formats JOSE header parameters (alg, typ), payload claims (sub, iss, aud), expiration dates (exp), issued timestamps (iat), and signature strings without transmitting credentials across external networks.

Core Concepts

Understanding JWT token structure and inspection mechanics:

• Three-Part Structure: Separates tokens into Header (cryptographic metadata), Payload (claims and authorization scopes), and Signature (verification hash) delimited by dots (.).
• Base64URL Unescaping: Decodes URL-safe Base64 strings by restoring standard padding (=) and mapping - to + and _ to /.
• Claims & Expiration Inspection: Converts Unix epoch integers (exp, iat) into ISO 8601 timestamps and checks whether the token has expired.

How to use the tool?

1. Enter JWT String: Paste your raw Header.Payload.Signature token into the input box or click Load Sample.
2. Execute Decode: Click Decode JWT Token to unbase64url header and payload JSON objects.
3. Inspect Claims: Review algorithm details, expiration status, and formatted Header and Payload JSON structures.

Related Developer Utilities

If you work with JSON Web Tokens, auth headers, and Base64 encodings, explore these complementary tools:

• JWT Expiry Checker: Calculate live Time-To-Live countdowns and timeline progress for JWTs.
• Base64URL to Base64 Converter: Convert URL-safe Base64 strings to standard Base64.
• Base64 Decoder: Decode generic Base64 strings into UTF-8 text.
• JSON Formatter: Format and validate structured JSON documents.

REST API Integration

Blueutils provides a free REST API endpoint (POST https://blueutils.com/api/jwt/jwt-decoder) to programmatically decode JSON Web Tokens (JWT), unbase64url header and payload JSON objects, and inspect claim parameters.

API Request Parameters

API Request Payload Examples

cURL

curl -X POST https://blueutils.com/api/jwt/jwt-decoder \
  -H "Content-Type: application/json" \
  -d '{
    "rawToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
  }'

Python

import requests

url = "https://blueutils.com/api/jwt/jwt-decoder"
payload = {"rawToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.json())

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String jsonPayload = """
            {
                "rawToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
            }
            """;

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://blueutils.com/api/jwt/jwt-decoder"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API Response Parameters

API Response Payload Examples

Success Response (HTTP 200 OK)

{
  "isValid": true,
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "signature": "SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "inspection": {
    "algorithm": "HS256",
    "tokenType": "JWT",
    "isExpired": false,
    "expiresAt": null,
    "issuedAt": "2018-01-18T01:30:22.000Z",
    "issuer": null,
    "subject": "1234567890",
    "audience": null
  }
}

Validation Failure Response (HTTP 400 Bad Request)

{
  "isValid": false,
  "error": "Invalid JWT format: A valid JSON Web Token must contain exactly 3 dot-separated segments."
}

Rate Limit Exceeded Response (HTTP 429 Too Many Requests)

{
  "error": "API rate limit exceeded. Please wait or contact support@blueutils.com."
}

Why use an API to decode JWTs?

Integrating the JWT Decoder API into authentication middleware, API gateways, or AI agent tool calling provides key benefits:

• Rapid Script Validation: Unpacks bearer tokens and checks scopes or roles before routing API requests.
• Optimized Token Efficiency for AI Agents: LLMs frequently introduce parsing syntax errors when manually decoding Base64URL strings. Calling the API extracts claims deterministically without token consumption.
• Deterministic Accuracy Without Hallucinations: Ensures 100% strict UTF-8 decoding and standard ISO 8601 timestamp conversion.

Native Usage

How to decode JWT tokens locally in terminal environments or scripts:

Windows (CMD / PowerShell)

# Decode JWT payload in PowerShell
$token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
$payload = $token.Split('.')[1]
$base64 = $payload.PadRight($payload.Length + (4 - $payload.Length % 4) % 4, '=').Replace('-','+').Replace('_','/')
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64))

Linux / Unix (Bash)

# Decode JWT payload in Linux
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" | cut -d'.' -f2 | base64 --decode

Python

Using Python:

import base64
import json

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
payload_b64 = token.split('.')[1]
payload_b64 += '=' * (-len(payload_b64) % 4)
payload = json.loads(base64.urlsafe_b64decode(payload_b64))
print(json.dumps(payload, indent=2))

Java

Using Java:

import java.util.Base64;

public class JwtDecoderExample {
    public static void main(String[] args) {
        String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
        String payloadJson = new String(Base64.getUrlDecoder().decode(token.split("\\.")[1]));
        System.out.println("Payload: " + payloadJson);
    }
}