JWT Decoder
Runs in your browser — your data is never uploaded.
Paste a JSON Web Token to instantly see its decoded header and payload as readable JSON. This is a decode-only viewer — it never verifies the signature, since that would require the issuer’s secret or public key. Runs entirely in your browser, so tokens carrying real session or user data never leave your device.
0 characters · runs entirely in your browser
How to use JWT Decoder
- 1
Paste the JWT into the box (the full header.payload.signature string).
- 2
Click “Decode” to see the header and payload as JSON.
- 3
Copy the result, or download it as a .txt file.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Does this verify the token’s signature?+
No, and it deliberately never will — verifying a signature needs the issuer’s secret (HMAC) or public key (RSA/ECDSA), which this tool never has and shouldn’t. It only decodes the base64url-encoded header and payload.
Is my token uploaded anywhere?+
No. Decoding runs entirely in your browser — nothing is sent to a server, which matters since a JWT often carries real user or session data.
Why does it say the token isn’t valid?+
A JWT has exactly three dot-separated, base64url-encoded parts. If a part isn’t valid base64url or doesn’t decode to JSON, it isn’t a well-formed JWT.