JWT Decoder
Paste a JSON Web Token to decode its header and payload instantly — fully client-side, your secret stays local.
About this tool
Paste any JSON Web Token and inspect its header and payload formatted as readable JSON — the whole decode runs in your browser, so tokens never leave your device.
Debugging auth flows is the daily use: check what "exp" says, see which algorithm a token claims, or confirm what roles an API generates. The signature stays untouched and unverified by design.
FAQ
Is decoding a JWT safe?
Yes — the header and payload are only base64url-encoded, not encrypted. Decoding does not verify or expose secrets; only the signature confirms authenticity.
What is inside the payload?
Claims like subject, issuer, expiry and role. You can modify a payload visually, but the signature will no longer validate.
Why does @, < or odd characters appear?
Some tokens have non-UTF-8 claims. The decoder handles standard UTF-8; exotic encodings may display as escaped characters.