JWT Decoder
Paste a JSON Web Token to see its decoded header and payload. Decoding only — the signature is not verified, and nothing is sent anywhere.
HEADER
—
PAYLOAD
—
SIGNATURE (not verified)
—
Decoding, not verifying
Anyone can decode a JWT's header and payload — that data is only base64-encoded, not encrypted. This tool does not and cannot verify the signature, since that requires the issuer's secret key or public key, which should never be pasted into a browser tool. Never trust a JWT's contents until the app that issued it verifies the signature server-side.