JWT Decoder

Paste a JWT and see the decoded header and payload, formatted as JSON.

🔒 This decoder runs 100% in your browser — the token you type is never sent to any server. Still, avoid pasting production tokens with sensitive data into third-party tools.

What is a JWT

JWT (JSON Web Token) is a compact format for securely transmitting information between two parties, widely used for API authentication. A JWT has three dot-separated parts: header, payload and signature.

Decoding is not validating

This tool only decodes the header and payload (which are just Base64Url, not encrypted) for reading — it does not verify the token's signature. Anyone can read a JWT's content, so never put sensitive data (passwords, IDs) in a token's payload.

Frequently asked questions

Is a JWT encrypted?

No. The header and payload are only Base64Url-encoded, not encrypted — anyone with the token can read the content. The signature guarantees integrity, not secrecy.

Does this tool verify the token signature is valid?

No — it only decodes the content for reading. Verifying the signature requires the issuer's secret or public key, which this tool never asks for.

Is my data sent to any server?

No. All decoding happens locally in your browser, in JavaScript.