Security & Generators

JWT Decoder

Decoding a token can help you understand a header or inspect the shape of a payload while debugging authentication. It does not establish who issued the token or whether any claim is trustworthy. Paste a compact, three-part JWT to read its first two JSON segments. No verification key is accepted, and signature verification is deliberately outside this tool’s scope. Avoid pasting live credentials when a sample will do; browser extensions and clipboard tools are separate from this page’s local processing.

Your workspace

Runs locally in your browser

This tool decodes JWT data locally. It does not verify the token signature.

Result

Your input is processed locally in your browser unless explicitly stated otherwise. Inputs are not saved by this tool.

How to use this tool

Paste a three-part JWT and select Decode. Inspect the decoded header and payload; verify authenticity separately in your application.

Example

Input

eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjMifQ.

Output

Header: {"alg":"none"}; payload: {"sub":"123"}

What does this tool do?

A signed JSON Web Token commonly has three dot-separated segments: header, payload and signature. The first two contain Base64URL-encoded JSON.

Common mistakes and limitations

This tool decodes JWT data locally. It does not verify the token signature. Decoded claims, including expiry and identity, are untrusted. Encrypted five-part JWE tokens are not supported.

Frequently asked questions

Does decoding prove a token is valid?

No. Signature, issuer, audience and lifetime checks must happen in the consuming application.

Related tools