Inspect the header and payload of any JWT.
This tool runs entirely as JavaScript in your browser. The token you paste — which may carry session identifiers or account details in its payload is never transmitted over the network to this site's server or any third party, and is never written to a cookie, to browser storage, or to any log — there is nothing on our end to breach, subpoena, or accidentally leak, because it was never received in the first place. Closing or refreshing this tab clears it completely.
This describes only what this specific tool does with what you type into it. It doesn't cover the rest of this site — see the Privacy Policy for how analytics and advertising cookies are handled elsewhere.
—
—
—
A JSON Web Token has three Base64url-encoded parts separated by dots: a header describing the signing algorithm, a payload carrying the claims (user ID, expiry, roles, and so on), and a signature. This tool decodes the header and payload so you can read them as JSON, without needing the secret key.
It is useful when you are debugging authentication — checking whether a token actually contains the claim your backend expects, or confirming an "exp" (expiry) timestamp is what you think it is. Decoding is not the same as verifying: this tool does not and cannot confirm the signature is valid, because that requires the private or shared secret the token was signed with, which never leaves your server.
Because the payload is only encoded, not encrypted, anyone holding a JWT can already read its contents — never put secrets a client should not see inside a JWT payload.
No. Verifying a signature requires the secret or public key the token was signed with. This tool only decodes the readable header and payload.
No, it is only Base64url-encoded. Anyone can decode a JWT and read its claims, which is why sensitive data should never be placed inside one.
The token must have exactly three dot-separated segments. Extra whitespace, a truncated copy-paste, or a token that is actually encrypted (JWE, not JWS) will fail to decode here.