JWT Decoder
Decode JSON Web Tokens (JWT) locally in your browser. Inspect header and payload claims quickly without uploading tokens to a server.
Paste your JWT
Paste a JWT in the format header.payload.signature.
This tool will decode and pretty-print the header and payload. Signature verification is not performed.
Header
alg: –, typ: –
{/* header JSON will appear here */}
Payload
exp: –, iss: –
{/* payload JSON will appear here */}
JWT decoder FAQs
Can this tool tell me if a JWT is valid or trusted?
No. This decoder only base64url-decodes the header and payload so you can read the claims. It does not verify the signature, issuer, or audience. For security decisions, always validate tokens in your backend or via your authentication provider.
Why do you recommend not pasting very sensitive tokens?
Even though decoding happens in your browser, best practice is to treat high-value tokens (admin, long-lived refresh tokens, production API tokens) as secrets and inspect them only in controlled, internal tools or logs.
What if my JWT is encrypted (JWE) instead of signed (JWS)?
This tool expects standard signed JWTs (JWS) with three dot-separated segments. Encrypted JWTs (JWE) cannot be fully decoded without keys and are not supported here.
Related developer tools
📢 Advertisement Space
Responsive In-Content Ad Unit
Share this tool
Help someone else shortcut their work
Send this page to a friend, student, or teammate who could benefit from it.