JWT Decoder
Decode a JSON Web Token to read its header and payload — privately.
Paste a JSON Web Token to instantly see its decoded header and payload as readable JSON. Everything happens in your browser: unlike many online JWT tools, your token is never sent to a server, so it is safe to inspect tokens that contain sensitive claims. Note that the signature is not verified — this tool decodes, it does not validate authenticity.
Frequently asked questions
Is it safe to paste a real token here?
Safer than most tools: decoding runs entirely in your browser and nothing is uploaded. Still, treat any live token carefully and rotate it if in doubt.
Does it verify the signature?
No. It decodes the header and payload so you can read the claims. Verifying the signature requires the secret or public key and should be done server-side.
Why is the payload readable if JWTs look encrypted?
A standard JWT is encoded (Base64URL), not encrypted. Anyone can decode the payload, which is why you should never put secrets in it.