JWT decoder

Header

Payload

Sections are color-coded and date fields (iat, exp, nbf…) show the date on hover. It does not verify the signature or decrypt anything: a JWT is not encrypted, only Base64-encoded. Runs entirely in your browser.

This JWT decoder reads the header and payload of a JSON Web Token in your browser, with nothing sent to any server.

Inspect your tokens

A JWT has three parts: header, payload and signature. This tool decodes the first two so you can see exactly what data the token carries, with full privacy — everything runs in your browser.

FAQ

Is a JWT encrypted?

No. The header and payload are only Base64URL-encoded, so anyone can read them. The signature guarantees integrity, but doesn't hide the content — never put sensitive data in a JWT.

Does this tool verify the signature?

No. It only decodes the token so you can see its content. Verifying the signature requires the secret key, which you should never paste into a website.

Is my token sent to a server?

No. Everything is decoded in your browser; the token never leaves your device.