JWT Decoder
Paste a JWT to inspect its header and payload — decoded locally in your browser. Nothing is transmitted, so your token stays yours.
A JWT is just encoded JSON — not encrypted
A JSON Web Token consists of three Base64URL parts: a header describing the signing algorithm, a payload of claims (who you are, when it expires), and a signature proving the payload wasn't tampered with. Anyone can decode and read the payload — the signature only prevents modification, not reading. Never put secrets in a JWT payload.
Frequently asked questions
Is it safe to paste my token here?
This decoder runs entirely in your browser — the token is never sent to any server, and you can even disconnect from the internet and keep decoding. Still, as a general habit, treat tokens like passwords and avoid pasting them anywhere unnecessary.
Does this verify the signature?
No — signature verification requires the secret or public key, which only your backend has. This tool decodes and displays the contents, plus readable timestamps for standard time claims (exp, iat, nbf).