JWT decoder
A JWT (JSON Web Token) has three dot-separated parts: a header, a payload of claims, and a signature. This decoder Base64URL-decodes the header and payload so you can read what a token contains. It does not verify the signature — and critically, it never sends your token anywhere, so it is safe to paste real tokens.
JWT decoder
Read a JWT’s header & payload
0 bytes of your file have left this device. Counted live in this tab, not claimed — open your browser’s Network tab and watch.
How it works
- 1
Paste your token or input.
- 2
Read the decoded result on the right.
- 3
Copy anything you need — it never leaves your browser.
Frequently asked questions
Is it safe to paste a real token?
Yes. Decoding happens entirely in your browser — the token is never uploaded or logged.
Does it verify the signature?
No. It only decodes the header and payload for inspection. Verifying a signature requires the secret/key and should be done server-side.