JWT Decoder
Paste a JSON Web Token to read the header and payload. Signature bytes are shown but not verified—never paste production secrets on a shared device.
Enjoying this tool?
Part of Code & data tools
About JWT Decoder
A JSON Web Token has three Base64URL segments: header, payload, and signature. This decoder reads the JSON claims locally so you can debug exp, sub, and custom fields. It does not check the signature, so a decoded token is not proof that it is valid.
How to Use JWT Decoder
Paste a JWT (header.payload.signature). Read the pretty-printed header and payload. Treat the signature line as opaque bytes—verification belongs on a trusted backend.
When to Use JWT Decoder
API debugging: See which claims a test token contains. Support: Explain an expired exp timestamp without sharing the token with a third-party site. Learning: Show how JWTs are structured before introducing signature verification.
Why Use This JWT Decoder?
Online JWT inspectors that upload tokens are a leak risk. This page stays in the browser.
How to use
1. Paste a JWT (header.payload.signature).
2. Read the pretty-printed header and payload.
3. Treat the signature line as opaque bytes—verification belongs on a trusted backend.
Frequently asked questions
Does this verify the JWT signature?
No. It only Base64URL-decodes the header and payload. Verification needs the signing key on a trusted backend.
Is my token uploaded?
No. Decoding runs in this browser. Still avoid pasting live access tokens on a shared computer.
What if decode fails?
Check that you pasted all three segments and that the payload is JSON, not an encrypted JWE.