JWT Decoder
Paste a JSON Web Token to see its decoded header and payload. This decodes only — it does not verify the signature, so it can't confirm a token is authentic, only show you what it contains. Nothing is uploaded.
Common questions
Does this verify the token's signature?
No. This tool only decodes the header and payload, which are just Base64URL-encoded, not encrypted. It does not check the signature, so it cannot tell you whether a token is authentic — only what claims it contains.
Is it safe to paste a real production token here?
The decoding happens entirely in your browser and the token is never sent anywhere, so it is technically safe. That said, it's good practice to avoid pasting tokens tied to production systems into any third-party tool.
What is a JWT?
A JSON Web Token (JWT) is a compact, three-part string (header, payload, signature) commonly used to represent claims for authentication and authorization between services.