JWT Decoder
Inspect JSON Web Token header, payload, and claims — entirely client-side.
decode
output
About JWT decoding
A JSON Web Token is three base64url segments joined by dots — a header describing the signing algorithm, a payload of claims, and a signature. JWTs routinely carry identifiers, emails, roles, and tenant membership, which is exactly why many online decoders feel invasive: you paste a production token into a third-party server. This tool never does that — atob() andJSON.parse run in this tab, and the token goes nowhere.
How decoding works
The first two segments are base64url without padding, so decoding first normalizes-/_back to +//, restores padding, and decodes as UTF-8. The result is then parsed as JSON. The third segment is the signature — it is not decodable into meaningful data and is never touched here.
Important caveats
Decoding a JWT does not verify it. Anyone can mint a token claiming any subject; what makes a token trustworthy is a valid signature from a key you trust. Treat this output as "what the token says," not "what the token is allowed to do." For local verification, use a tool that checks the HMAC or asymmetric signature with a known key. Also note the exp claim shown in the status line is only a hint — the real check must happen server-side.
Related tools
Reformat the decoded claims with the JSON formatter, compare two tokens' payloads with the JSON difftool, or understand the base64url encoding itself with the Base64 encoder.
FAQ
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser with atob() and JSON.parse. The token never leaves this tab.
Does this verify the signature?
No — it only decodes the header and payload. Treat any decoded claims as unverified until you check the signature on the issuing side.