JWT Decoder
Paste a JWT to see its header and payload. Decoding happens locally — this tool never verifies a signature against a secret, because doing that safely would require either shipping your secret to the browser or sending your token to a server. Neither happens here.
Header
Payload
What this tool does and doesn't do
A JWT's header and payload are Base64URL-encoded, not encrypted — anyone holding the token can already read them, so decoding them locally loses nothing over decoding them on a remote server. The difference is that a remote decoder can log every token it ever receives, including yours.
This tool intentionally stops at decoding. It does not check the signature, because a trustworthy signature check needs your service's real secret or public key, and that key should never leave your own infrastructure.