Dev Tools
JWT Decoder
The JWT Decoder takes a JSON Web Token and splits it into its header and payload, showing you the decoded claims in readable JSON without verifying the signature. Developers use it constantly to debug authentication flows, check what claims an access token actually contains, or confirm an expiry timestamp during testing.
Because JWTs often carry sensitive session data, the decoding happens entirely in your browser — the token you paste in is never sent to a server, so it's safe to inspect real tokens from a live application.
How to Use the JWT Decoder
- Open the JWT Decoder tool.
- Paste your JWT into the input box.
- View the decoded header and payload JSON.
- Check claims like expiry, issuer, or subject as needed.
Frequently Asked Questions
Does this tool verify the JWT's signature?
No, it only decodes the header and payload, which are just Base64URL-encoded JSON; it does not check the signature, so it can't confirm the token hasn't been tampered with.
Is it safe to paste a real production JWT into this decoder?
Yes — decoding happens entirely in your browser, so the token, including any sensitive claims it carries, is never sent to or stored on a server.
Why is the payload readable without knowing the signing secret?
A JWT's header and payload are only Base64URL-encoded, not encrypted, so anyone can decode them; the signature is what proves the token's authenticity, not what hides its contents.