JWT Decoder

Inspect a JSON Web Token's header and payload. No signature verification.

Token

Anatomy of a JWT

A JWT is three Base64url-encoded segments joined by dots:

header.payload.signature

This tool only decodes. It doesn't verify the signature. Decoding requires no secret; verifying does.

Decoding only. We never verify the signature. Anyone holding the secret could mint a token that decodes the same way.

Header

Paste a token to see its header.

Payload

Paste a token to see its payload.

Signature

(none)

The URL below carries the token. Be careful — anyone with the URL sees the token.

Token is too long to include in the URL.

Share URL

Anyone with this link can read the values it contains. Do not use it for sensitive data.

Frequently asked questions

Does this verify the signature?

No, it only decodes the token. Verifying the signature needs the issuer's key.

Are tokens uploaded?

Decoding happens locally. Tokens can also appear in the optional share URL, so avoid sharing sensitive or production credentials.