The decoder says the token is malformed.

Check that all three segments are present and that nothing was cut off at the end. A token from a cookie sometimes arrives URL-encoded; decode that first with the URL tool.

Can it verify an HS256 or RS256 signature?

Not here. Verification needs the shared secret or the public key and belongs on the server that issued the token.

Decode a JWT and read its claims

2 min readLast updated 12 September 20262 steps · runs on this page

A JSON Web Token is three Base64 segments joined by dots. The first two are plain JSON once decoded, which is what this recipe shows: the header and the claims, formatted, with the token cleaned of the whitespace and quotes it often picks up when copied out of a header or a log.

The steps

1
Clean hidden charactersvia Invisible Character Detector
Strips the surrounding whitespace, quotes and invisible characters that come with a token copied from a request header or a log line.
2
Decode JWTvia JWT Decoder
Splits on the dots, Base64url-decodes the first two parts and prints them as JSON.

Token

Ctrl+Enter runs · nothing leaves this tab

What decoding does and does not tell you

Decoding shows what the token says about itself. It does not show whether the token is genuine; that is the signature's job, and checking it needs the key, which a page like this does not have and should not be given. So a decoded token tells you which user and which scopes a request claims to carry, and when the claim expires, and nothing about whether a server would accept it. The JWT decoder tool linked from the second step says the same on its page, because the distinction is the one people most often get wrong.

Reading the claims

Claim	Meaning
iss	Who issued the token; usually the auth server's URL.
sub	The subject, normally a user id.
iat	Issued-at, seconds since 1970.
exp	Expiry, same units; the decoder shows it as a date and whether it has passed.
aud	Which service the token is for; a token for one service is rejected by another.

Custom claims such as role or tenant are whatever the issuer decided. The decoder explains the registered ones and leaves the rest as they are.

Why the token is treated as a secret

A token is a credential: anyone holding it can act as its subject until it expires. Decoding it here is safe because the page does not send it anywhere, but pasting it into a third-party site is the same as pasting a password. For the same reason the share link on this page should not be used for a real token; the sample above has a made-up signature and cannot authenticate anything.

Questions

The decoder says the token is malformed.: Check that all three segments are present and that nothing was cut off at the end. A token from a cookie sometimes arrives URL-encoded; decode that first with the URL tool.
Can it verify an HS256 or RS256 signature?: Not here. Verification needs the shared secret or the public key and belongs on the server that issued the token.