JWT Decoder
Paste a JWT to see its header and payload as formatted JSON. Decoding runs in your browser and the token is never sent anywhere.
JWT DecoderRuns in your browser
Important: decoding only reads the token. It does not verify the signature and does not prove the token is authentic or unexpired.
Your input stays in your browser and is not sent to a server by this page.
About this tool
A JWT has three Base64URL parts: header, payload and signature. Anyone can read the first two, so never put secrets in a JWT payload. Verify signatures on your server with a trusted library.