DEVELOPER TOOL
JWT Decoder
Decode a JSON Web Token's header and payload without a server.
About this tool
Paste a JSON Web Token to decode its header and payload into readable JSON. This only decodes and formats the token's contents — it does not verify the signature, so a decoded token isn't proof that it's authentic or hasn't been tampered with.
Decoding happens entirely in your browser; the token is never sent anywhere.
Frequently asked questions
- Does this verify the token is valid or authentic?
- No — verifying a signature requires the secret key or public key used to sign it, which this tool never has. This only decodes the publicly readable header and payload sections.
- Why are there three parts separated by dots?
- A JWT has three Base64URL-encoded sections: header (algorithm and token type), payload (the claims/data), and signature (used to verify the first two haven't been altered).
- Is it safe to paste a real token here?
- Decoding happens locally in your browser and nothing is transmitted, but treat any token like a credential — avoid pasting production tokens into tools you don't control if they contain sensitive claims.