Paste a JWT to decode its header and payload. This is a decoder only, it does not verify the signature.
Google AdSense Banner
This area will contain advertisements after approval.
Google AdSense Banner
This area will contain advertisements after approval.
A JWT has three base64url-encoded segments separated by periods: header.payload.signature. This tool decodes the header and payload segments (each is just base64url-encoded JSON) and displays them pretty-printed, along with the raw signature segment.
Verifying a JWT's signature requires the secret key (for HS256) or public key (for RS256/ES256) it was signed with, information this tool never asks for or has access to. Decoding shows you what's inside the token, it doesn't confirm the token is authentic or hasn't been tampered with, that check has to happen on the server that issued it.
Decoding the classic example token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c splits into three periods-separated segments. The first decodes to the header {"alg": "HS256", "typ": "JWT"}, the second decodes to the payload {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}, and the third segment, SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c, is shown as-is as the raw signature, since decoding it further would require the secret key used to create it.
Treating a successfully decoded token as proof it's authentic, decoding only reveals the contents, anyone can construct a JWT-shaped string with an arbitrary header and payload, only signature verification (which requires the secret or public key) confirms it wasn't tampered with.
Storing sensitive data in a JWT payload assuming it's hidden, the payload is only base64url-encoded, not encrypted, anyone who has the token can decode and read it just as this tool does.
Pasting a token missing one of its three segments (or with extra periods) and expecting it to decode, a JWT must have exactly three period-separated segments, header.payload.signature, malformed input will be rejected.
Decoding happens entirely in your browser, your token is never sent to or stored on our servers. That said, treat JWTs like any sensitive credential, avoid pasting tokens from production systems into any third-party tool if you're not sure how it handles data.
No, this tool only decodes existing tokens. Use our JWT Generator to create a new signed token.
Google AdSense Banner
This area will contain advertisements after approval.