JWT Decoder
Decode JWT headers and payloads without sending your token to a server.
Decoded header and payload will appear here.
What is a JWT Decoder?
A JWT decoder reads the header and payload segments of a JSON Web Token and displays them as readable JSON. It's useful for debugging authentication flows, inspecting claims, or checking token expiry without writing any code.
Decoding vs verifying
Decoding simply reads the Base64URL-encoded header and payload — anyone can do this without knowing the signing secret. Verifying checks the signature against a secret or public key to confirm the token hasn't been tampered with. This tool only decodes; it does not and cannot verify authenticity.
Is it safe to paste my token here?
Decoding runs entirely client-side, so your token never leaves your browser. That said, treat production tokens carefully and avoid pasting them into tools you don't trust, since a decoded payload can reveal sensitive claims.
Frequently asked questions
What is a JWT?+
A JSON Web Token (JWT) is a compact, URL-safe token format commonly used for authentication. It has three parts — header, payload and signature — separated by dots.
Does this tool verify the JWT signature?+
No. This tool only decodes the header and payload so you can read their contents. It does not verify the signature, so it cannot confirm the token is authentic or unmodified.
Is my token sent to a server?+
No. Decoding happens entirely in your browser using JavaScript. Your token is never transmitted or logged.
Why does decoding fail on my token?+
A JWT must have exactly three dot-separated Base64URL segments. If a segment is missing, truncated, or not valid Base64URL-encoded JSON, decoding will fail with a specific error.