JWT Decoder
Inspect JWT headers and payloads instantly. Your token is processed entirely in your browser — it is never transmitted to a server.
Decoding ≠ Verification
Decoding a JWT reveals its contents but does not verify the signature. A decoded token should not be trusted as valid without server-side signature verification. Your token is processed entirely in your browser — it is never sent to a server.
Tip: Press Ctrl+Enter to decode.
What is a JWT?
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe means of representing claims to be transferred between two parties. A JWT consists of three Base64URL-encoded parts separated by dots:
- Header — specifies the token type (
JWT) and the signing algorithm (e.g.HS256,RS256). - Payload — contains the claims: registered ones like
sub(subject),iat(issued at),exp(expiry), and any custom application-specific claims. - Signature — produced by signing the header and payload with a secret or private key to prevent tampering.
Decoding ≠ Verifying
Decoding a JWT only reveals its contents. It does not confirm that the token is legitimate or untampered. Any application that trusts a JWT must verify the signature against the issuer's public key or shared secret. Never accept a decoded token as valid based on decoding alone.
Privacy
JWT payloads often contain sensitive information (user IDs, roles, email addresses). This tool processes the token entirely in your browser using JavaScript's atob() and JSON.parse(). No part of your token is sent to any server or logged anywhere.