JWT Decoder
Decode a JWT's header and payload. Decode only — this never verifies a signature. Nothing you paste ever leaves this tab.
This decodes a JWT — it does not verify its signature. A token that decodes cleanly is not a validated one; anyone can produce a JWT with an arbitrary payload. Never paste a secret or private key here, and remember a token is a credential — treat it the way you'd treat a password.
0 characters
Nothing you type here is sent anywhere.
What this tool does
JWT Decoder reads a JSON Web Token — the `header.payload.signature` string used all over modern auth — and shows you what's inside its header and payload as readable JSON. It's built for the everyday need to check what claims a token actually carries: an expiry, a user ID, a set of scopes, an issuer.
This tool decodes only. It never checks whether the signature is valid, because that would require a secret or public key, and this tool will never ask you for one — see below for why that distinction matters.
How to use it
Paste a JWT into the input box. The decoded header and payload appear below automatically, pretty-printed. If what you pasted isn't a valid JWT shape, or either segment doesn't decode to valid JSON, the error tells you exactly which part failed.
Copy the decoded output with one click, or download it as a text file. Clear the input any time to start over.
Why nothing leaves your device
A JWT is a credential, full stop — it's frequently the exact thing standing between an anonymous request and an authenticated one. Pasting a live token into a server-backed decoder means that token crosses the network and lands on infrastructure you don't control, which is a real way tokens get compromised, not a theoretical one. It happens because decoding a JWT feels like a read-only, harmless action, when the token itself is anything but harmless in the wrong hands.
Decoding here is just Base64URL and `JSON.parse`, both built into the browser — there's no server involved and never will be, since decoding a JWT client-side needs nothing external. Check your network tab while using it and you'll see no request carrying what you pasted.
What this does well — and what it doesn't
This correctly decodes the header and payload of any standard JWT, reports specifically which segment failed if the token is malformed, and never touches, requests, or evaluates the signature in any way.
It does not verify the signature, does not check expiry (`exp`) or any other claim against the current time, and does not tell you whether a token is still valid or was ever legitimately issued — a decoded token only tells you what it claims, not whether those claims are true. For that, the token needs to be verified server-side, with the appropriate key, which is a fundamentally different (and non-client-side) operation.