JWT Decoder
Decode JSON Web Token header and payload segments locally without claiming that the token signature is valid. Processing takes place locally in your browser.
Start using
What JWT Decoder does
Decode JSON Web Token header and payload segments locally without claiming that the token signature is valid.
Worked example
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature
Readable header and payload JSON; signature shown separately
How it works
A JWT uses Base64URL-encoded segments separated by periods. Decoding reveals the header and payload; cryptographic verification requires the correct key, allowed algorithm and claim-validation rules.
Developer workflows
- Inspect token claims during API debugging
- Check expiry and issuer fields
- Compare tokens without sending them to a third-party decoder
Security and compatibility checks
- Decoding is not signature verification.
- Tokens can contain sensitive identifiers or permissions.
- Do not trust exp, aud, iss or role claims until verification succeeds.
Frequently asked questions
Does a decoded JWT prove the token is authentic?
No. Anyone can construct header and payload text; authenticity requires signature verification.
Why is the payload readable without a password?
Most JWTs are signed, not encrypted. Their contents are encoded for transport and should not contain secrets.
Processing takes place locally in your browser.