Decode and inspect JWT tokens
JWT Decoder splits a JWT into its header and payload, base64url-decodes each, and pretty-prints the resulting JSON, entirely in your browser — nothing is uploaded to a server. It decodes only: it does not verify the signature, so it cannot tell you whether a token is authentic or has been tampered with. Any string with the correct three-part, base64url-encoded-JSON shape will decode successfully, valid signature or not.
What is a JWT?
A compact, URL-safe token format with three dot-separated parts — header, payload, and signature — commonly used to carry authentication claims.
Does this tool verify the signature?
No. It only decodes the header and payload; the signature segment isn't checked or even displayed. A forged or tampered token with the right shape will decode exactly like a genuine one.
Is my token uploaded to a server?
No, decoding happens entirely in your browser.
Can I use this to confirm a token is valid or trustworthy?
No — decoding is not validation. To actually verify a token, check its signature against the issuer's key using a JWT library on a server or trusted environment, not by eye in a decoder like this.