Paste a JWT below to instantly decode and inspect its header, payload, claims, and signature. Everything runs in your browser — your token is never uploaded, stored, or logged.
JWT decoding happens locally in your browser. Your token is not uploaded to our server.
Do not paste production access tokens or credentials into any online tool unless you understand the security implications.
Header
Payload
Claims / Token Information
Warnings
Signature
Signature decoded. Cryptographic verification is not performed.
How to Use
- Paste your JWT (a string in the form
header.payload.signature) into the input box. - Click Decode JWT to view its decoded header, payload, and a human-readable claims summary.
- Use Copy on any section, Copy Token Information for a text summary, or Download Report for a JSON file.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties — commonly used for authentication and authorization. A JWT has three Base64URL-encoded segments separated by periods: a header (describing the token, e.g. its signing algorithm), a payload (the actual claims — who the token is for, when it was issued, when it expires, and so on), and a signature (used by the issuing server to verify the token hasn’t been tampered with).
This Is a Decoder, Not a Verifier
This tool decodes and displays a JWT’s contents — it does not perform cryptographic signature verification. It never asks for a secret key, private key, or password, and it never claims a token is “valid,” “secure,” or that a user is “authenticated.” Verifying a signature requires the same secret or public key the issuing server used, which this tool deliberately does not collect. Anyone can decode a JWT’s header and payload — that’s by design, since JWTs are only Base64URL-encoded, not encrypted — but only the party holding the correct key can confirm a signature is genuine.
FAQ
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser using native JavaScript. Your token is never sent to our server, never placed in a URL, never logged to the console, and never stored — it disappears the moment you leave or refresh the page.
Does this tool verify the signature?
No — see “This Is a Decoder, Not a Verifier” above. It decodes and displays the signature segment and its byte length, but never checks it against a key.
Is it safe to paste a production token here?
This tool never transmits your token anywhere, but as a general rule, avoid pasting production access tokens or credentials into any online tool unless you understand the security implications and trust the tool’s implementation.
Do I need an account?
No. The tool is free to use and doesn’t require sign-up.