JWT Decoder

Paste a JWT to decode its header and payload. This is a decoder only, it does not verify the signature.

Google AdSense Banner

This area will contain advertisements after approval.

Google AdSense Banner

This area will contain advertisements after approval.

How It Works

How JWT decoding works

A JWT has three base64url-encoded segments separated by periods: header.payload.signature. This tool decodes the header and payload segments (each is just base64url-encoded JSON) and displays them pretty-printed, along with the raw signature segment.

Why this doesn't verify the signature

Verifying a JWT's signature requires the secret key (for HS256) or public key (for RS256/ES256) it was signed with, information this tool never asks for or has access to. Decoding shows you what's inside the token, it doesn't confirm the token is authentic or hasn't been tampered with, that check has to happen on the server that issued it.

Frequently Asked Questions

Is it safe to paste a JWT here?

Decoding happens entirely in your browser, your token is never sent to or stored on our servers. That said, treat JWTs like any sensitive credential, avoid pasting tokens from production systems into any third-party tool if you're not sure how it handles data.

Can I use this to create a valid JWT?

No, this tool only decodes existing tokens. Use our JWT Generator to create a new signed token.

Related Tools

JWT Generator

Generate a signed HS256 JWT from a JSON payload.

Open Tool

Hash Generator

Generate MD5, SHA-1 and SHA-256 hashes of text.

Open Tool

Google AdSense Banner

This area will contain advertisements after approval.