Token decoders: JWT, SAML, OAuth, OIDC and cookies
A token decoder unpacks the credentials and session payloads that web applications pass around — JSON Web Tokens, SAML assertions, OAuth and OpenID Connect tokens, and cookies — so you can read their claims, issuer and expiry without verifying or altering them.
Web, API & Tokens tools
JWT Decoder
Decode a JWT's header and payload and inspect its claims and expiry.
SAML Response Decoder
Base64-inflate a SAML response and view the XML assertion.
OAuth 2.0 Token Decoder
Inspect OAuth access and refresh tokens, including JWT-shaped ones.
OpenID Connect (OIDC) Token Decoder
Decode OIDC id_tokens and read standard identity claims.
Cookie & Session Decoder
Parse a Cookie header into name/value pairs and decode session blobs.
ViewState (.ASPX) Decoder
Base64-decode ASP.NET __VIEWSTATE and inspect its structure.
PHP Serialized Object Decoder
Parse PHP serialize() output into a readable structure.
Protobuf Raw Decoder
Decode raw protocol-buffer wire bytes without a schema.
GraphQL Query Decoder
Pretty-print and inspect GraphQL queries and schema documents.
Data URI Parser
Split a data: URI into MIME type, encoding and decoded payload.
Which decoder do I need?
- Three dot-separated Base64URL chunks starting with eyJ
- JWT
- An id_token returned by an OpenID Connect login
- OpenID Connect (OIDC) Token
- A long Base64 SAMLResponse form field
- SAML Response
- A Cookie or Set-Cookie header
- Cookie & Session
- A string starting with data:
- Data URI
About web, api & tokens decoding
Modern authentication is built on bearer tokens, and most of them are readable by design. A JWT is three Base64URL segments — header, payload and signature — and its claims are plain JSON. A SAML response is Base64-encoded (and often deflated) XML. Decoding them is the first step in debugging a login that fails, a permission that is missing or a session that expires too early.
Decoding is not verification. Anyone can read a JWT's payload; only a party holding the signing key can confirm the token is genuine. These tools show you what a token claims, and flag expiry and timestamps in human-readable form, but they never treat a decoded token as trustworthy.
Because tokens are credentials, privacy matters here more than anywhere. Every decoder on this bench runs in your browser tab, so a production token you paste is never sent to a server.
Frequently asked questions
Is it safe to decode a JWT online?
It is safe when the decoding happens locally, as it does here — the token never leaves your browser. Avoid pasting live production tokens into tools that send input to a server, and rotate any token you suspect has been exposed.
Can a decoder tell me if a JWT is valid?
It can show whether the token is well-formed and whether its exp and nbf claims are in the past or future. Confirming the signature requires the issuer's secret or public key, which is a verification step, not a decoding one.
Why do OAuth access tokens sometimes fail to decode?
OAuth 2.0 does not require access tokens to be JWTs. Many providers issue opaque random strings that only the authorisation server can interpret; there is nothing inside them to decode.
Last reviewed · found a mistake? contact@decoder.tools