JWT Decoder
Decode a JSON Web Token (JWT) to inspect its header and payload. Does not verify the signature.
This only decodes the token's header and payload — it does not verify the signature (that requires the secret or public key, which a browser tool can never safely hold). Your token is decoded entirely in your browser and is never sent to a server.
This tool is temporarily unavailable.
Please check back later.
How to use this tool
- 1Paste a JWT (starting with "eyJ...") into the box.
- 2The decoded header and payload appear automatically as formatted JSON.
Features
- Decodes both the header and payload of a JWT.
- Clear error message if the token is malformed.
- No account or sign-up required.
Privacy
Your token is decoded entirely in your browser and is never sent to a server, logged or stored — important since JWT payloads often contain personal data.
Frequently asked questions
Is this JWT decoder free?
Yes, and there is no limit on how many tokens you can decode.
Does this verify the signature?
No. Verifying a signature requires the secret or public key used to sign it, which should never be pasted into a browser tool. This only decodes and displays the header and payload.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never sent anywhere — but as a general rule, avoid pasting production tokens into any tool you don't fully trust.
Why do I get an error?
A JWT must have exactly three dot-separated, Base64URL-encoded parts. Check that the token was copied in full and without extra whitespace.