JWT Decoder
Decoding a token can help you understand a header or inspect the shape of a payload while debugging authentication. It does not establish who issued the token or whether any claim is trustworthy. Paste a compact, three-part JWT to read its first two JSON segments. No verification key is accepted, and signature verification is deliberately outside this tool’s scope. Avoid pasting live credentials when a sample will do; browser extensions and clipboard tools are separate from this page’s local processing.
Your workspace
Runs locally in your browserThis tool decodes JWT data locally. It does not verify the token signature.
Result
Your input is processed locally in your browser unless explicitly stated otherwise. Inputs are not saved by this tool.
How to use this tool
Paste a three-part JWT and select Decode. Inspect the decoded header and payload; verify authenticity separately in your application.
Example
Input
eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjMifQ.Output
Header: {"alg":"none"}; payload: {"sub":"123"}What does this tool do?
A signed JSON Web Token commonly has three dot-separated segments: header, payload and signature. The first two contain Base64URL-encoded JSON.
Common mistakes and limitations
This tool decodes JWT data locally. It does not verify the token signature. Decoded claims, including expiry and identity, are untrusted. Encrypted five-part JWE tokens are not supported.
Frequently asked questions
Does decoding prove a token is valid?
No. Signature, issuer, audience and lifetime checks must happen in the consuming application.
Related tools
Base64 Encoder & Decoder
Encode and decode UTF-8 text without losing Unicode.
Open tool Developer ToolsJSON Formatter & Validator
Format and validate JSON with readable indentation.
Open tool Security & GeneratorsPassword Generator
Create random passwords with configurable character sets.
Open tool