JWT Decoder
Decode and inspect JSON Web Tokens.
The decoded header and payload will appear here.
About the JWT Decoder
Decode and inspect JSON Web Tokens locally. Paste a JWT to see its header and payload claims in readable JSON — handy for debugging auth flows. Tokens are decoded in your browser and never sent anywhere.
How to use it
- 1Paste a JWT (the xxxxx.yyyyy.zzzzz string).
- 2Read the decoded header and payload, including standard claims.
- 3Check expiry and issuer while you debug.
Anatomy of a JWT
A JSON Web Token is three Base64url-encoded parts separated by dots: a header, a payload and a signature. The header names the signing algorithm; the payload holds the claims — who the user is, when the token expires, who issued it; and the signature lets a server verify the token wasn't altered. Crucially, the header and payload are only encoded, not encrypted, so anyone can read them — which is exactly what this decoder does. That's why you should never put secrets in a JWT payload, and why real security comes from verifying the signature on your server, not from the token being opaque.
Common uses
- Debugging why an authenticated request is being rejected by checking the claims.
- Inspecting a token's expiry and issuer while building an auth flow.
- Confirming which user or scopes a token represents during development.
Frequently asked questions
- Does this verify the token's signature?
- No — it decodes and displays the contents for inspection. It does not validate the signature, and your token never leaves your browser.
- Is it safe to paste a real token?
- Decoding happens entirely client-side, but treat any live token as a secret and avoid sharing your screen.