JWT Decoder — Inspect Header and Payload Locally
Paste any JSON Web Token (JWT) and see its header and payload as pretty-printed JSON. Signature is not verified — this is a debugging tool for inspecting what a token claims.
What a JWT contains
Three parts separated by dots: header (algorithm), payload (claims like user id, expiry), and signature. The first two are Base64-encoded JSON; the signature verifies they weren't tampered with.
Never paste production tokens somewhere unsafe
This tool runs locally, so pasting is safe here — but a JWT is essentially a login token. Never paste one into a random online decoder.
Frequently Asked Questions
Does it verify the signature?
No. Signature verification requires the server's secret or public key. This tool inspects the payload only.
Can it decode encrypted JWTs (JWE)?
Only signed JWS tokens. Encrypted JWEs need the decryption key.
Is my token sent anywhere?
No — decoding happens in your browser. Nothing is logged or transmitted.