JWT Decoder
Decode JWT header and payload in your browser without verifying signatures.
Tool workspace
Decodes JWT header and payload in your browser. Decode ≠ verify — signatures are not validated. Tokens are never uploaded.
How it works
Paste a JWT (header.payload.signature). The tool Base64URL-decodes the header and payload and pretty-prints the JSON.
Decode ≠ verify: the signature is shown but never validated. Empty input clears the result—no error. Malformed tokens show a validation message.
Tokens stay in your browser and are never uploaded.
Decode ≠ verify: the signature is shown but never validated. Empty input clears the result—no error. Malformed tokens show a validation message.
Tokens stay in your browser and are never uploaded.
Examples
- eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjMifQ. → header + payload JSON
Privacy
Privacy: this tool processes JWTs locally in your browser. We do not log or store tokens. Login is not required.
FAQ
Does this verify the JWT signature?
No. Decoding is not authentication. Signatures are not validated.
Is my token uploaded?
No. Decoding runs entirely in your browser.
Do I need an account?
No. All published tools work for guests without login.