JWT Decoder
Decode a JWT header and payload, inspect registered claims, and check expiry without sending the token anywhere.
Tokens are decoded locally in your browser. Nothing is uploaded or logged.
JSON Web Token
Paste a JWT to read its header and payload. The signature is decoded for inspection only; it is not verified.
A decoded token is not a trusted token. Verify the signature on your server before accepting any claim, and never paste production secrets here.
Header
Payload
Registered claims
What is actually verified
Decoding is just Base64URL parsing; anyone can craft those bytes. Verification checks the signature with the issuer's key and validates issuer, audience, and expiry. This page only decodes, so treat every value as untrusted input.
Privacy
The token stays in this tab. Do not paste a live access token from a production system into any third-party site, and rotate it if you suspect it leaked.