JWT Decoder
Inspect a token's readable header and payload.
Show detailsHide details
Decode a token's header and payload locally to inspect claims while debugging. Decoding only reveals encoded content; signature validation and claim checks are separate security steps.
Loading calculator...
What can a JWT decoder reveal?
It decodes the readable header and payload from a JSON Web Token so you can inspect their JSON claims.
Decoding is not signature verification. Do not treat displayed claims as trusted or paste live credentials into an unapproved tool.
Inspect a JSON Web Token
JWT Parts, Claims, and Trust
A JSON Web Token commonly contains three dot-separated parts: a Base64URL-encoded header, a Base64URL-encoded payload, and a signature segment. The header describes signing metadata, and the payload contains claims such as issuer, subject, audience, or expiry. Base64URL is an encoding, not encryption, so a signed token's readable parts are generally visible to anyone holding it. A decoder helps developers inspect a token during debugging, but it cannot establish that the issuer created it or that its claims are acceptable. A relying application must verify the signature using a trusted key and permitted algorithm, then validate the claims it depends on. Never put secrets in a readable payload or share an active token casually.
Key Features
💡 Pro Tips
- →Use decoded fields to investigate a development issue, then validate the token through the application's trusted verification path.
- →Treat tokens as credentials: redact them from logs, screenshots, support tickets, and public paste services.
Common Mistakes
Trusting a claim because it appears in the decoded payload
An attacker can construct or alter an unverified token; displayed content is not proof of authenticity.
Assuming a signed JWT hides its payload
A typical signed JWT is readable by its holder; signing provides integrity when correctly verified, not confidentiality.
Last updated: 2026-10-27
Table of Contents
Quick Facts
Related Tools
Privacy Guaranteed
Your data never leaves your browser. All calculations are 100% private.
Frequently Asked Questions
Does decoding verify a token?
No. Anyone can decode an unsigned or tampered token. Verify the signature and validate issuer, audience, expiry, and other relevant claims in a trusted server-side flow.
Can JWT contents be secret?
A signed JWT is generally readable by anyone who has it. Do not put secrets in its payload, and do not share live credentials.
What are JWT claims?
Claims are named values in the payload, such as issuer, subject, audience, or expiry. Their presence does not make them trustworthy until the token is verified and the application validates them.
Should I paste a production token here?
Avoid it unless your security policy explicitly permits it. Tokens can grant access; use a redacted or non-production example when possible.