JWT Decoder
Decode a JWT header and payload locally without sending the token to a server.
Decoded Result
Decoding does not verify the signature or prove that the token is authentic or safe.
What a JWT Decoder Does
A JWT decoder reads the Base64URL-encoded header and payload as JSON. It does not validate the signature, issuer, audience, expiry, or trustworthiness of the token.
What the three JWT parts mean
A compact JWT normally contains a header, payload, and signature separated by periods. The header names the signing method, the payload carries claims, and the signature is what a trusted verifier must check before accepting those claims.
Decoded claims are not proof
Values such as exp, iss, aud, and sub are readable assertions, not verified facts. This decoder does not check a key, expiry, issuer, or audience. Never grant access or make a security decision from decoded content alone.
Frequently Asked Questions
Does this verify the JWT signature?
No. This tool only decodes the header and payload. Signature verification requires the correct key and validation policy.
Is my token sent to a server?
No. The token is decoded only in your current browser and is not stored.
Why can anyone read a JWT payload?
JWT header and payload segments are encoded, not encrypted. Never place secrets in an unencrypted JWT payload.