JWT Decoder
Paste a JSON Web Token to inspect its header and payload. This tool decodes only — it does not verify the signature.
The JWT Decoder reads a JSON Web Token's header and payload and shows the content as readable JSON. This tool only decodes — it does not verify the token's signature.
Your files are processed locally in your browser and are not uploaded.
This tool only decodes the token — it does not verify the signature.
How to use JWT Decoder
- 1
Paste the full JWT
The three parts separated by dots.
- 2
Click decode
- 3
View the header and payload
Already formatted as readable JSON.
Decoding isn't the same as validating
A JWT has three parts: header, payload and signature. This tool reads the first two — which aren't encrypted, just Base64url-encoded — but doesn't confirm whether the signature is authentic. A token with a readable header and payload can still have an invalid signature or have been tampered with.
What usually shows up in the payload
Depending on who issued the token, the payload may contain information like the associated user, an expiration date, and permissions — useful for debugging an authentication issue without needing access to the system that issued the token.
When should you use this tool?
Developers
Check the content of an authentication token during development.
Debugging
Verify whether a token expired or has the expected data in its payload.
Privacy and processing
The pasted token — which may contain a real user's session data — is only read in your browser and isn't saved anywhere.
Frequently asked questions
- Does this verify the token's signature?
- No. This tool only decodes the header and payload for inspection — it does not verify authenticity.