JWT Decoder
Paste a JSON Web Token to decode its header and payload. This does not verify the signature.
Last updated
About this tool
A JWT is three Base64URL-encoded segments — header, payload, and signature — separated by dots. This tool splits the token, decodes the header and payload as JSON, and formats them for reading; the signature segment is shown as-is, in raw Base64URL. Standard timestamp claims (iat, exp, nbf) are annotated with their human-readable date so you don't have to convert them by hand.
This tool does not verify the signature — decoding a JWT tells you what it claims, not whether it's authentic. Anyone can construct a token with an arbitrary header and payload; only checking the signature against the issuer's real secret or public key (something this browser-only tool has no way to know) proves a token hasn't been tampered with. Never trust a decoded JWT's contents for anything security-sensitive without verifying it server-side first. Nothing you paste here is sent to a server — the entire tool runs as JavaScript in your browser tab.