JWT Decoder
7 toolsDecode a JWT's header and payload.
Runs in your browser — your files and text stay on your device
Decode a JSON Web Token to read its header and payload, including claims like expiry (exp) and issuer (iss). Decoding doesn't verify the signature, so a readable token isn't necessarily a trustworthy one. The token is decoded locally in your browser and never uploaded, which is why it's safer than pasting it into a site that sends it to a server.
Base64 & URLJWT DecoderJWT GeneratorFile ↔ Base64HTML Entity Encode/DecodeBase32 Encode/DecodePunycode (IDN) Converter
A JWT must have exactly 3 dot-separated segments.
How to use this tool
- 1Paste a full JWT (three dot-separated segments).
- 2The Header and Payload decode and pretty-print automatically.
- 3Copy either section as formatted JSON.
Frequently asked questions
Does this verify the signature?
No — it only decodes the header and payload segments; it cannot confirm the token is valid or untampered.
Is it safe to paste a real JWT here?
Decoding happens entirely in your browser and the token is never sent anywhere, but still treat JWTs like passwords.