JWT Decoder
Paste a JSON Web Token to instantly see its decoded header and payload as readable JSON.
Your files are processed in your browser and never uploaded to any server.
How to use this tool
- 1Paste your JWT (the full string with two dots).
- 2The decoded header and payload appear automatically as JSON.
- 3If the token is malformed, an error message explains why.
Frequently asked questions
Does this verify the token's signature?+
No, it only decodes the readable parts — it doesn't check whether the signature is valid.
Is my token sent anywhere?+
No, decoding happens entirely in your browser.
JWTs are used everywhere in modern authentication, but they're just Base64-encoded JSON under the hood — this tool splits a token into its header and payload and decodes both so you can inspect claims like expiry, issuer, or user ID while debugging an API or auth flow. It does not verify the signature and never sends your token anywhere, since decoding is a purely local, offline operation. Because a JWT often contains sensitive claims, avoid pasting tokens from production systems you don't control into any online tool, including this one — reading it locally in your own browser is the safest way to inspect one.