JWT Decoder
Decode JWT header and payload instantly in your browser — nothing is uploaded.
The signature is not verified — this tool only decodes the header and payload.
Decode JWT tokens online
Paste any JSON Web Token and the header and payload are decoded instantly in your browser. Base64url encoding is handled automatically, including padding and URL-safe characters, and the result is pretty-printed for easy reading. Everything runs locally — no data is uploaded anywhere.
Use this tool to inspect claims, check expiry times, or verify the algorithm without touching a server. Only the header and payload are shown; the signature is not validated, so treat decoded payloads as untrusted unless you verify the token through your own authentication flow.
FAQ
Is my token sent anywhere? No. Decoding is done entirely in your browser with no network requests.
Why is the signature not verified? Signature verification requires the secret or public key, which this tool does not store. Use your authentication library to verify tokens before trusting their claims.
What is base64url? JWT uses a URL-safe variant of base64 that replaces + with - and / with _, and omits padding. This tool handles that encoding automatically.