JWT Decoder
Paste any JWT and instantly read its header and payload as pretty-printed JSON, plus the signature and token metadata. Decoding is pure base64url — no network calls, no secret needed. Local, private and useful for debugging auth flows.
Paste a token like header.payload.signature and each segment is decoded from base64url. Standard claims (iat, exp, sub…) are surfaced in their own table with human-readable dates.
Paste a JWT
Frequently asked questions
Can this tool verify that my JWT is valid?
No — verification requires the secret or public key that signed the token. This tool only decodes the three segments so you can inspect their contents.
Is decoding considered a security risk?
JWT payloads are base64-encoded, not encrypted. Anyone can read them; treat them as public data. Never put secrets in a token you share.