JWT Decoder

Paste a JSON Web Token and see its decoded header and payload — without sending the token anywhere.

JWT

Header

Payload

Walkthrough

How to use it

Paste a full JWT (three dot-separated parts) into the input box.
The header and payload are decoded and pretty-printed automatically below.
The signature is not verified — this tool only decodes the readable parts, it doesn't check them against a secret or public key.
If the token is malformed, the status line explains why.

Use cases

When you'd use this

Debugging an auth issue. Check what claims (expiry, roles, subject) are actually inside a token your app received, without writing a decode script.

Verifying token expiry during testing. Read the exp claim directly to confirm a token is still valid before chasing a bug elsewhere.

Understanding a third-party token. See what an API or identity provider actually puts inside its tokens.

FAQ

Common questions

Does this verify the signature?

No — verifying a signature requires the issuer's secret or public key, which this tool intentionally never asks for. It only decodes the Base64URL-encoded header and payload, which are readable by design in a JWT.

Is my token sent to a server?

No. Decoding uses only the browser's built-in Base64 functions; the token never leaves this tab.

Why does it say the token is malformed?

A valid JWT has exactly three dot-separated parts. If your input is missing a part or has extra whitespace, decoding will fail.