Does this verify the JWT signature?

No. Verifying a signature requires the issuer's public key (or shared secret), and asking you to paste a private key into a webpage would be exactly the kind of thing a privacy-first site should not do. Use this tool for inspecting and debugging claims; verify signatures with your provider's SDK or a trusted local CLI like jwt-cli.

Why is the signature segment showing as binary garbage?

The third segment of a JWT is a binary signature (HMAC for HS algorithms, an RSA or ECDSA signature for RS/ES algorithms). Base64-decoding it produces opaque bytes by design. The tool shows the signature length and detected algorithm from the header — those are useful signals; the raw bytes themselves are not.

Base64 / JWT Decoder

IAM & SecurityMulti-Cloud

Decode base64 strings and JWT tokens with auto-detection, claim inspection, and expiry status.

Last verified: May 2026

Encoded Input

Raw Output

Output will appear here...

About This Tool

JWTs are three base64url-encoded segments joined by dots. The Base64 / JWT Decoder auto-detects whether you have pasted a plain base64 string or a full JWT, then either base64-decodes the payload or splits the JWT into header, payload, and signature with each segment fully decoded. Expiration, not-before, and issued-at claims are formatted as human-readable timestamps and flagged when expired so a token problem is obvious immediately rather than discovered by squinting at a unix timestamp.

Real-World Scenario

An on-call alert fires at 11pm: 'Mobile API returning 401 to a percentage of users.' The mobile client logs include a redacted JWT. You paste it into the decoder. The header says alg: RS256 and kid: rotated-key-2026-04. The issuer rotated keys two weeks ago and you forgot to refresh the JWKS cache on this region's edge. A 30-second config push restores service. Without the decoder you would have spent another five minutes hunting the kid claim in raw base64.

When to Use This Tool

•Debugging a 401 from an OIDC-protected API by checking the access token's audience, scopes, and expiration without copy-pasting it into a third-party site.
•Inspecting the contents of an AWS Cognito or Azure AD ID token after a sign-in flow to confirm the right claims arrived from the identity provider.
•Decoding a base64 string from a CloudFormation parameter, Kubernetes secret, or CI/CD environment variable that you suspect contains a JWT.
•Verifying that a JWT was issued by the expected issuer (iss claim) before chasing a deeper validation problem.

Pro Tips

TIP

If the payload decodes but the timestamps look wrong (year 56432 or year 1970), the issuer is emitting Unix milliseconds instead of seconds. RFC 7519 specifies seconds; some non-standard issuers ignore that. Divide by 1000 to read it.

TIP

A token that fails 'expired' even though you just issued it usually has the wrong clock on the issuer or the verifier. JWT validators reject tokens with iat or nbf more than 30-60 seconds in the future to defend against clock skew — the symptom can look identical to expiration.

How It Works Under the Hood

The decoder first inspects the input for the JWT shape (three base64url segments joined by dots). If found, it splits, base64url-decodes each segment, and parses header and payload as JSON. Otherwise it treats the input as raw base64 (or base64url) and decodes it as a string. Expiration handling normalizes timestamps to human-readable UTC and flags exp/nbf/iat values that are in the past or unreasonably far in the future.

Frequently Asked Questions

Does this verify the JWT signature?: No. Verifying a signature requires the issuer's public key (or shared secret), and asking you to paste a private key into a webpage would be exactly the kind of thing a privacy-first site should not do. Use this tool for inspecting and debugging claims; verify signatures with your provider's SDK or a trusted local CLI like jwt-cli.
Why is the signature segment showing as binary garbage?: The third segment of a JWT is a binary signature (HMAC for HS algorithms, an RSA or ECDSA signature for RS/ES algorithms). Base64-decoding it produces opaque bytes by design. The tool shows the signature length and detected algorithm from the header — those are useful signals; the raw bytes themselves are not.

Related Learning Guides

Multi-Cloud IAM Rosetta Stone12 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.