A JWT's header and payload are Base64-encoded, not encrypted — readable by anyone who has the token. Paste one here to instantly see its decoded claims, entirely in your browser, without ever sending the token anywhere.
How to use the jwt decoder tool
- 1
Paste the JWT
Add the full token, including all three dot-separated parts.
- 2
Read the header and payload
Both are decoded and pretty-printed as JSON instantly.
- 3
Copy what you need
Copy the header or payload independently.
Common use cases
Debug an auth issue
Check a token's claims (like exp or sub) to see why authentication is failing.
Inspect a token's expiry
Decode the payload to see the exp claim and check when a token expires.
Verify token structure during development
Confirm a token your backend issued contains the claims you expect.
Frequently asked questions
No — decoding just reads the header and payload, which are Base64-encoded but not encrypted. Verifying the signature requires the issuer's secret or public key, which this tool never asks for or needs.