JWT decoder
Shows what is inside a JSON Web Token – for debugging logins and APIs – without sending the token anywhere.
What you enter is processed in this browser only and is not transmitted.
Loading tool …
How it works
- Paste the token (with or without “Bearer”).
- Click “Decode JWT”.
- Read header, payload and the converted times; copy individual parts.
Notes and limitations
- Decoding happens only in your browser. Still, treat tokens like passwords and do not paste production tokens into tools you do not trust.
- The signature is not verified. A decoded token can have been forged – never trust its content without verification on the server.
- Encrypted tokens (JWE, five parts) cannot be read without the key.
Frequently asked questions
Does this check whether the token is genuine?
No. It only decodes the content. Verifying the signature requires the secret or public key and must happen in your application.