JWT decoder
Decode JWT header and payload locally without verifying the signature.
Input
Result
Inputs are processed in your browser and are not sent to the server. Privacy by design
How to use
- Decode JWT headers and payloads for test tokens, local debugging, authentication flow checks, and documentation examples.
- Paste or type only sample data that is safe to inspect.
- Review the result before copying it into code, docs, or tickets.
How it works
A JWT has Base64URL encoded sections. This tool decodes readable header and payload data, but it does not verify the signature.
Examples
- Inspect a test token's expiration claim.
- Check which algorithm a header declares.
- Review a documentation sample without sending it to a server.
FAQ
Does this verify the JWT?
No. It decodes only and does not prove the token is trusted.
Can I paste production tokens?
Avoid real access tokens and customer data.
What is exp?
It is commonly the expiration timestamp claim.
Why does decoding fail?
The token may be malformed or not Base64URL encoded.
Token review workflow
JWT decoding is useful for inspecting harmless test tokens during authentication debugging. Check the header algorithm, issuer, audience, expiration, and custom claims before deciding whether the token shape matches your application flow. Decoding does not prove that a token is valid or trusted, so signature verification still belongs in the application or identity provider. When sharing examples in tickets or documentation, replace real user IDs, emails, roles, and tenant identifiers with dummy values before pasting the token.
Security and limits
Decoded tokens can expose user IDs, roles, and claims, so use test tokens whenever possible.
Important note
Tokens are decoded in the browser and are not sent as tool input, but pasting production access tokens or refresh tokens is not recommended. Use sample or test tokens whenever possible.