JWT Decoder
Read the header and claims out of a JSON Web Token. Decoding happens in this tab, so the token is never transmitted.
What this does not do
Decoding is not verification. A JWT’s payload is base64, not encryption — anyone holding the token can read it, and anyone can craft one with whatever claims they like. Only a signature check against your secret or public key tells you a token is genuine, and that has to happen on your server, never here.
Common questions
Does this verify the token signature?+
No, and no browser tool should. Verification needs your secret or public key, and sending that to a web page would defeat the point. This reads the header and claims only; genuineness has to be checked on your server.
Is it safe to paste a real token here?+
The decoding happens entirely in your browser and the token is never transmitted. That said, a JWT is a credential — do not paste a live production token into any web page, including this one, if you cannot verify that claim yourself.
Why can I read the payload without a key?+
A JWT payload is base64-encoded, not encrypted. Anyone holding the token can read every claim in it. The signature proves the token was not altered; it does not hide the contents.