JWT Decoder
Inspect a JWT header and payload locally without implying signature validation.
Your input stays on this device and is processed in your browser.How to use JWT Decoder
- Paste a compact JWT containing header, payload, and signature segments.
- Decode both JSON objects locally and review the unverified warning.
- Inspect or copy the formatted header and payload without treating them as trusted data.
Readable does not mean trusted
The first two segments of a JWT are Base64URL-encoded JSON, and Base64URL is an encoding rather than a cipher. Anyone holding the token can read the claims inside it without a key, which is worth remembering before putting anything private in a payload.
The third segment is a signature, and this tool does not check it. Nothing here verifies the issuer, the audience, the expiry or that the token was signed by anyone at all — the header and payload shown are what the token claims about itself, and a token can claim whatever its author typed.
So this answers what is in a token, which is the useful question while debugging. Whether a token is valid is a question for the service that will accept it, using the key only that service has.
Frequently asked questions about JWT Decoder
Does this tool verify a JWT signature?
No. It only decodes readable content. A backend that knows the expected algorithm and trusted key must verify the signature.
Does a decoded token prove who issued it?
No. Anyone can construct header and payload segments. Issuer, audience, expiry, not-before, and signature checks remain required.
Is the token sent to a server?
No. Base64URL decoding and JSON parsing happen only in the current browser tab, but sensitive production tokens should still be handled carefully.