Encode & decode
JWT Decoder
Inspect the header and payload of a JSON Web Token.
Runs entirely in your browser — nothing is uploaded
This decodes the token only — it does not verify the signature. Never paste a token you still rely on for access.
Frequently asked questions
Is my token sent to a server?
No. Decoding happens entirely in your browser, which matters because a JWT is a credential and pasting one into a remote service can expose your session.
Does this verify the signature?
No. It decodes and displays the contents. Verifying the signature requires the secret or public key, which should never leave your server.