Inspect any JSON Web Token. Paste a JWT to decode its header and payload instantly. This tool only decodes — it does not verify the signature, so never trust a token based on this output alone.
Decode only. This tool reveals the header and payload but does not verify the signature. An unverified token proves nothing.
How to Use
- Paste the JWT into the box.
- Click Decode Token.
- Read the header and payload. Note the signature is shown but never verified.
Key Features
- Instant decoding — header and payload rendered as readable JSON.
- Honest about signatures — the signature part is displayed but never verified.
- UTF-8 safe — correctly decodes international characters in claims.
- 100% private — decoding happens entirely in your browser.
FAQs
Does this tool verify the signature?
No. It only decodes the header and payload so you can inspect them. Signature verification needs the secret or public key and must happen on your server, never in a browser tool.
What is a JWT?
A JSON Web Token has three base64url-encoded parts separated by full stops: a header, a payload of claims, and a signature.
Is it safe to paste tokens here?
Decoding happens locally in your browser and nothing is uploaded. Still, tokens can carry sensitive data, so avoid pasting live production secrets into any web page.
Related Tools
Try these related tools: Base64 Encoder, JSON Formatter and SHA-256 Hash Generator.