JWT Decoder

Paste a JWT and its header and payload are decoded as you type. Nothing is sent anywhere — decoding happens entirely in this page.

This does not verify the signature

A JWT's header and payload are just Base64url-encoded JSON — anyone can read them without a key, which is what this tool does. Checking the third part, the signature, requires the secret (for HS*) or public key (for RS*/ES*) that signed the token, which this browser-only tool never has and never asks for. The signature above is shown exactly as it appears in the token, undecoded — treat any claims you see as unverified until you check them against the real signing key server-side.