Paste a JSON Web Token to see its header & payload. Decoding is 100% local in your browser - token never leaves this page.
JWT Decoder
The JWT Decoder unpacks a JSON Web Token into its three parts - header, payload, and signature - so you can inspect the claims inside without any backend or library.
How a JWT is built
A JWT is three Base64URL-encoded sections separated by dots: the header (algorithm and type), the payload (claims such as user id, issuer, and expiry), and the signature (which verifies integrity). Decoding just reads the header and payload - it does not require the secret.
Frequently Asked Questions
Is a JWT encrypted?
No. The header and payload are only Base64URL-encoded, so anyone can read them. The signature verifies integrity but does not hide the contents.
Does decoding verify the signature?
Decoding reads the claims but does not verify the signature, which requires the secret or public key on your server.
Is it safe to paste my token here?
Decoding happens entirely in your browser and your token is not sent anywhere. Still, only inspect tokens you are authorised to handle.
What are common JWT claims?
Typical claims include sub (subject), iss (issuer), exp (expiry), iat (issued-at), and custom fields your application defines.
Related Developer Tools
Privacy-first: client-side tools process your input in your browser. Free to use, no sign-up. See our Privacy Policy and Disclaimer.