Developer Tools
JWT Decoder
Decode a JSON Web Token header and payload in your browser. Signatures are displayed, not verified.
Your information is processed in your browser and is not uploaded to our servers.
Token
This tool does not check signatures, expiry or issuer claims. Treat decoded payloads as untrusted data.
Header
Payload
Signature (unverified)
About this tool
A JWT is three Base64URL segments: header, payload and signature. This page decodes the first two as JSON. It does not verify the signature, expiry or issuer.
How to use
- Paste a token.
- Read the header and payload.
- Treat the payload as untrusted data unless you verify it in your own backend.
Formula and methodology
Split on “.”. Pad each of the first two segments, replace -/_ , then atob and JSON.parse. The remainder is shown as the signature.
Worked example
The sample token’s payload includes a sub, name and iat claim. The signature string is displayed only.
Frequently asked questions
Is my token uploaded?+
No. Decoding stays in this tab.
Can I verify HS256 or RS256 here?+
No. Verification needs the secret or public key and belongs on a server you control.
Related tools
JSON Formatter
Pretty-print and minify JSON in the browser.
Open tool →
Base64 Decoder
Decode Base64 back to text.
Open tool →
JSON Validator
Validate JSON and show parse errors clearly.
Open tool →
URL Decoder
Decode percent-encoded URLs.
Open tool →
Base64 Encoder
Encode text to Base64.
Open tool →
UUID Generator
Generate UUID v4 identifiers instantly.
Open tool →