JWT Decoder
Decode JSON Web Tokens and inspect header, payload, and signature
JWT Token
A JWT (JSON Web Token) is a compact, encoded string commonly used for authentication - it contains a header, payload, and signature packed together. This tool decodes a JWT so you can read its header and payload contents in plain JSON, useful for debugging authentication issues or inspecting what data a token actually carries.
Frequently asked questions
No - decoding just reads the header and payload, which are only Base64-encoded (not encrypted or hidden). It does not verify the token's signature, so a decoded JWT tells you what it CLAIMS, not whether it's a genuine, unmodified token from the issuing server.
Decoding happens in your browser, but as a general habit, avoid pasting tokens from live production systems into any third-party tool if the token grants real access - use a test/expired token when just learning how JWTs are structured.
A header (algorithm/token type), a payload (the actual claims/data), and a signature (used by the issuing server to verify the token hasn't been tampered with) - separated by dots in the token string.