Decode a JWT
Decode a JSON Web Token's header and payload to inspect its content.
Processed on your device. Nothing is sent to any server.
Decoding does not mean verifying. This tool shows the token's content, but does not check the signature or its cryptographic validity.
Decode a JSON Web Token's (JWT) header and payload to inspect its content, directly in your browser.
A JWT has three dot-separated parts: header, payload and signature. This tool decodes the first two (which are Base64URL-encoded, not encrypted) to show their content as readable JSON.
Use cases
- Debugging an authentication token during development.
- Checking what claims a JWT contains.
- Verifying a token's expiration date.
How it works
- 1
Paste the token
Copy the full JWT (with its three dot-separated parts).
- 2
Review the content
The header and payload are shown decoded and formatted.
Frequently asked questions
- Does this tool verify whether the token is authentic?
- No. Decoding only shows the token's content; it does not check the signature or whether the token was issued by a trusted source. For that you need to verify the signature with the corresponding secret or public key.
- Is a JWT's content encrypted?
- No, a standard JWT's (JWS) header and payload are only Base64URL-encoded, not encrypted: anyone can read them without needing any key.