JWT Decoder

Inspect a JWT's header, payload and claims without sending it anywhere.

Loading JWT Decoder…

How to use JWT Decoder

Open the JWT Decoder tool.
Paste or type your text, code or a token into the input field.
The output updates as you type. Adjust the options if you need a different format.
Copy the result, or share the URL to hand the exact input to someone else.

About JWT Decoder

A JSON Web Token packs three Base64url segments (header, payload and signature) separated by dots. This tool splits the token and decodes the header and payload so you can read the claims inside, entirely in your browser.

Decoding is not verification: it reveals what a token claims, not whether the signature is valid. Treat the payload as readable-but-untrusted until the issuer's signature is checked server-side.

What people use it for

Inspect the claims (sub, exp, iat, roles) in a token returned by an auth API.
Debug a rejected session by checking the exp expiry and iat issued-at times.
Confirm which algorithm (alg) and key id (kid) a token was signed with.
Read a token pulled from a request header without pasting it into an untrusted site.

Frequently asked questions

Is my token sent anywhere?

No. Decoding happens locally in your browser with no network request; nothing about the token leaves your machine.

Does this verify the signature?

No. It decodes the header and payload for inspection. Verifying requires the issuer's secret or public key. Use the JWT Signer tool to build HMAC-signed tokens.

Why does the token look like gibberish?

JWTs are Base64url-encoded, not encrypted. Anyone can decode the header and payload, so never put secrets in a JWT payload.

Is it private?

Every calculation happens on this page, in your own browser. Your input is never sent to a server and never logged, which also means the tool keeps working when you are offline.