JWT Decoder
This free JWT decoder opens a JSON Web Token and shows you exactly what is inside: the header with its signing algorithm, the payload with its claims, and the signature — displayed but never verified.
This tool does not verify JWT signatures. A token that decodes is not a token you can trust: signature verification requires the secret or public key on your own backend. Your token is decoded locally in your browser and never uploaded.
How to use
- Paste the JWT in header.payload.signature form into the box below.
- The header and payload appear as formatted JSON, and the signature is shown as-is with an explicit not-verified label.
- Verify signatures only in your own backend with the real secret or public key — never treat a decoded token as trusted.
Frequently asked questions
Does this tool verify the JWT signature?
No, and it never will in the browser: verification requires the secret (HS256) or public key (RS/ES256) and belongs on your backend. The signature segment is displayed for inspection only and clearly labeled as not verified. A token that decodes here proves nothing about its authenticity.
Is my token safe to paste here?
The token is decoded locally in your browser and never uploaded, stored or logged — there is no server involved. Still, treat tokens like passwords: avoid pasting live production tokens into any tool, and prefer test tokens whenever you can.
Why can I read the token without a key?
Because JWT payloads are Base64URL-encoded, not encrypted. Encoding is reversible by design; anyone who receives the token can read every claim. If the contents must be secret, you need encrypted tokens (JWE) — not a stronger signature.
What errors can the decoder report?
It fails fast with a specific message when the token does not have exactly three dot-separated segments, when the header or payload is empty, when a segment is not valid Base64URL, or when a decoded segment is not valid JSON — instead of showing garbled output.
Related tools
About this tool
This free JWT decoder opens a JSON Web Token and shows you exactly what is inside: the header with its signing algorithm, the payload with its claims, and the signature — displayed but never verified. A JWT is three Base64URL-encoded segments joined by dots, so anyone holding the token can read its contents; the signature is what makes it trustworthy, and only your backend holding the secret or public key can check it. That is why this tool shows an unmissable warning: decoding is not verification, and a token that decodes cleanly can still be forged, expired or revoked. Use it to debug claims during development, inspect an expired session, or see precisely what identity data a service is putting into tokens. Invalid tokens — wrong segment count, broken Base64URL, malformed JSON — are rejected with a clear error instead of half-readable garbage. Your token is decoded locally in your browser and never uploaded, stored or logged. Paste a token below to inspect it.