JWT Decoder
Decode JWT tokens to view Header and Payload as formatted JSON.
Report a Problem
Found a bug or have a suggestion? Help us improve this tool.
What is this tool?
JWT (JSON Web Token) decoder parses and decodes JWT tokens into readable format. JWTs consist of three Base64-encoded parts: header (algorithm info), payload (claims/data), and signature (verification). This tool decodes the header and payload for inspection without needing the signing secret. Essential for API debugging and authentication troubleshooting.
How to use
- 1
Paste JWT
Input your JWT token (eyJ... format).
- 2
View decoded parts
See header, payload, and signature status separately.
- 3
View results
Review the output.
Frequently Asked Questions
Can this tool verify JWT signatures?
No. Decoding the header and payload does not require the signing secret, so anyone can decode a JWT. Signature verification requires the original secret/key, which should never be shared. This tool shows whether a token is expired (exp claim) and displays all claims for inspection, but cannot cryptographically verify the signature.
Is it safe to share JWT tokens?
JWT access tokens should be treated like passwordsโdo not share them publicly. They grant access to resources. However, decoding a JWT reveals only the claims (user ID, roles, expiry), not the secret key. The security concern is token theft, not information exposure from the payload.
Is this safe to use with real passwords?
All operations happen locally in your browser. However avoid pasting passwords into any web tool if possible.