JWT decoder
Decode the Base64URL header and payload segments of a JSON Web Token locally. This is inspection only and does not verify the signature.
Local processing
Result
Your result will appear here
The input stays available if you need to adjust a setting.
How to use jwt decoder
- 1
Paste a JWT.
- 2
Decode its header and payload locally.
- 3
Inspect the claims without treating them as verified.
A realistic example
Inspect an expiry claim in a development token without pasting it into a remote debugger.
Supported formats and limits
Input: compact three-part JWT. Output: formatted JSON header and payload.
- Decoding does not verify authenticity or signature.
- Encrypted JWE tokens and malformed segments are not supported.
Questions people ask
Does a decoded token mean it is valid?
No. Trust requires signature verification using the correct key and algorithm.
Should I paste production tokens?
The tool is local, but you should still handle live credentials carefully and close the tab when finished.