Free tools
JWT Decoder
Inspect JWT header and payload locally. Signatures are not verified.
Processed in your browser. Your input is not uploaded.
Decode only: the signature is not verified. Decoded claims are not proof of identity or authorization.
Input
Paste a three-part JWT. Decoding happens locally; do not share sensitive tokens.
Ctrl / Cmd + Enter to runResult
Your result will appear here.
About this tool
Inspect the JSON header and payload of a three-part JWT for debugging. Decoding is local and retains number literals, but it does not establish whether the token is genuine, permitted or usable for login.
When to use it
- Inspect public claims in a development token.
- Check header and payload structure.
- Copy claim JSON for a debugging comparison.
How to use it
- Paste a three-part token or load the public example.
- Choose Decode and review header and payload separately.
- Copy either section or the combined JSON when needed.
Input and output example
Input
Header: {"alg":"HS256","typ":"JWT"}\nPayload: {"sub":"example"}Output
Separate header and payload JSON; signature not verified.
Important details
- No signature, issuer, audience or authorization verification is performed.
- Encrypted five-part tokens are not supported.
- Use trusted devices and pages for sensitive content; do not publicly share live credentials.
Frequently asked questions
Does decoding prove a token is valid?
No. Authenticity and authorization require verification by the system that accepts the token.
Why can an expired or altered token still be decoded?
Decoding reads the encoded JSON. It does not approve the token or enforce claim rules.