JWT Decoder
Decode a JWT's header and payload to inspect its claims.
How It Works
- 1Paste a JWT.
- 2Its header and payload are decoded and shown as formatted JSON.
Features
- Decodes header and payload
- Clear warning about signature verification
Privacy
All processing happens instantly in your browser. Nothing you enter is ever sent anywhere.
About JWT Decoder
A JSON Web Token is made of three parts separated by dots: a header specifying the signing algorithm and token type, a payload containing the claims — arbitrary data like a user ID or expiration time — and a signature. The header and payload are each just Base64URL-encoded JSON, not encrypted, which means anyone who has the token, whether that's a browser, a network proxy, or this tool, can decode and read their contents without needing any key at all.
This makes a JWT decoder useful for debugging authentication issues: inspecting what claims a token actually contains, checking whether an exp (expiration) claim has already passed, or confirming which algorithm a server used to sign it, all without needing backend access or a debugger attached to the server issuing the token.
The signature is what actually matters for trust, and it's the one part this tool can't do anything meaningful with — verifying it requires the exact secret key for HMAC algorithms or the issuer's public key for RSA/ECDSA algorithms, which a client-side decoding tool never has and never should be given. Decoding shows you what a token claims; it says nothing about whether those claims can be trusted.