Skip to content
DevTools

Data

JWT Decoder

Decode a JWT header and payload in your browser. Decoding does not verify the signature.

LocalProcessed locally — your token never leaves your browser.

Available actions: copy, clear, paste.

Decode is not verificationThis tool only reads the header and payload. It does not verify the JWT signature. Do not treat a decoded token as authenticated.
Header.payload.signature
Paste a JWT to decode the header and payload locally.

How to use

  1. 1. Paste a JWT

    Put the token in the input. A leading Bearer prefix is ignored. Decoding happens in your browser.

  2. 2. Decode the header and payload

    Choose Decode or press Ctrl+Enter / Cmd+Enter. The JWT decoder shows the header, payload, and common time claims.

  3. 3. Read the warning

    Decoding is not verification. This tool does not check the signature. Anyone can read an unsigned or unauthenticated JWT payload.

Examples

  • Read claims

    A typical JWT payload includes sub, name, iat, and exp. iat and exp are shown as local time and UTC.

  • Bearer token

    You can paste Authorization: Bearer <token> style values. The prefix is stripped before decode.

Frequently asked questions

Does decoding a JWT verify it?
No. This JWT decoder only base64url-decodes the header and payload. It does not verify the signature and must not be used as authentication.
Is my token sent to a server?
No. The token stays in your browser. Do not paste production secrets into untrusted devices, but this site does not upload the JWT.
Why can I read the payload without a secret?
JWT header and payload are encoded, not encrypted. The signature is what proves integrity. This page never checks that signature.

Related tools