JWT Decoder
Decode a JSON Web Token’s header and payload in your browser — no data leaves your machine.
What is a JWT decoder?
Paste a JSON Web Token to see its header and payload as readable JSON. This only decodes the token — it does not verify the signature, and nothing you paste is sent anywhere.
Common uses
- Inspecting an access or ID token to check its claims (sub, exp, roles) while debugging auth
- Checking whether a token has expired by reading the exp claim
- Seeing exactly what an OAuth/OIDC provider put in a token during integration work
FAQ
Does this verify the signature?
No. Decoding and verifying are different things — this tool only decodes, it never checks whether the signature is valid. A token that decodes successfully is not necessarily trustworthy.
Is it safe to paste a real production token?
Decoding happens entirely in your browser and nothing is sent anywhere, but treat tokens as secrets regardless — clear the field when you’re done, especially on a shared machine.
What if my token has more than three parts?
This decoder expects the standard three-part JWS format (header.payload.signature). Encrypted tokens (JWE, five parts) aren’t supported.