JWT Decoder

What this tool does

A JSON Web Token (JWT) is three base64url-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims (the actual data, like a user ID or expiration time), and a signature. This tool splits a pasted token on its dots, base64url-decodes the header and payload, and pretty-prints each as JSON. Everything happens locally in your browser — the token is never sent anywhere.

Example use case

When debugging an authentication flow, you often have an access token or ID token as an opaque-looking string and need to see what claims it actually carries — the subject, issuer, expiration time, or custom claims your backend added. Pasting it here instantly reveals the decoded header and payload without needing to write a script or use a backend debugger.

This tool does not verify the signature

Decoding a JWT and verifying it are different operations. Decoding just reads the base64-encoded JSON that anyone holding the token can already see; it proves nothing about whether the token is genuine. Verifying requires the signing key or public key and confirms the token hasn't been tampered with. Never treat a decoded (but unverified) JWT as trusted input in your own application code.