JWT Decoder
Decode JWT tokens to inspect header and payload — your token stays in your browser and is never sent to a server.
Frequently Asked Questions
What is a JWT and what is inside it?
A JSON Web Token (JWT) is a compact, signed token with three parts separated by dots: a header, a payload of claims, and a signature. The header and payload are Base64URL-encoded JSON that this tool decodes for you.
Is it safe to decode my JWT here?
Yes. The token is decoded entirely in your browser and is never sent anywhere. That said, avoid sharing real tokens publicly, since anyone with a valid token can use it until it expires.
Does decoding a JWT verify its signature?
No. Decoding only reveals the header and payload — it does not check the signature. Signature verification requires the secret or public key and is normally done on the server that issued the token.
Why can I read the payload without a password?
JWT payloads are encoded, not encrypted, so they are readable by anyone. The signature only guarantees the token has not been tampered with — it does not hide the contents, so never put secrets in a JWT payload.