JWT Decoder
Inspect a token's header and payload.
Decoded locally in your browser. The signature is not verified — that requires the signing key.
Runs entirely in your browser — nothing you enter is uploaded or sent to a server.
This only reads a token's claims — it does not check the signature, so a decoded token is no proof that it's genuine or unexpired. Avoid pasting live production tokens here, just as a precaution. Read our full disclaimer.
About this tool
A JWT (JSON Web Token) has three Base64URL parts — header, payload, and signature — separated by dots. This tool decodes the header and payload so you can inspect the claims (issuer, subject, expiry, etc.). It does not verify the signature: that requires the signing key, which belongs on a server.
Note
Decoding shows what's inside a token but does not prove it's valid — signature verification needs the secret/public key.
How to use
- 1Paste a JWT (header.payload.signature).
- 2Read the decoded header and payload as formatted JSON.
- 3Use the sample token to see how it works.
Features
- Decodes the header and payload into readable JSON.
- Handles Base64URL and missing padding.
- Clear message when a token is malformed.
Frequently asked questions
Does this verify the token's signature?
No. Verification requires the signing key and should happen on a server. This tool only decodes the header and payload for inspection.
Is it safe to paste a token here?
Decoding happens entirely in your browser — nothing is sent anywhere. Still, avoid pasting production tokens that are currently valid, as a precaution.
More developer tools
View allJSON Formatter
Paste raw JSON and get it neatly indented, minified, or validated — entirely in your browser.
Open toolBase64 Encoder / Decoder
Encode any text to Base64 or decode it back, instantly and locally — with full Unicode and emoji support.
Open toolUUID Generator
Create one or many version-4 UUIDs for IDs, keys, and test data — generated securely on your device.
Open tool