JWT Decoder
Decode a JSON Web Token's header and payload. Nothing is ever sent anywhere.
This only decodes the token — it does not verify the signature. A token decoding cleanly here says nothing about whether it's authentic, unmodified, or was actually issued by who it claims. Never treat successful decoding as proof a token is valid or safe to trust.
Token
Decoded locally. Your token never leaves your browser.
Paste a JWT to decode its header and payload.
Header
Payload
Signature (not verified)
Raw signature bytes, shown as-is. This tool has no key/secret to check it against.