JWT decoder
Decode a JWT header and payload without verifying the signature.
Loading tool…
Recommended next step
Related developer tools
After using JWT decoder, continue with JWT decoder.
Continue this path
Tools selected to complete the same task.
Tool guide
JWT decoder: how it works
Practical information to understand the result and use this tool correctly.
About JWT decoder
A JWT has three Base64URL parts: header, payload, and signature. This tool decodes the first two so you can inspect claims like sub, exp, and iss.
Signature verification is intentionally omitted. Never paste production secrets or assume a decoded token is trusted.
Decoding happens in the browser. Treat tokens as sensitive: they can include personal data in the payload.
How to use it
- 1Paste the full JWT string.
- 2Decode header and payload JSON.
- 3Check exp/nbf times and scopes—verify the signature in your backend, not here.
Frequently asked questions
- Why is the signature not checked?
- Verification needs the issuer’s secret or public key. A public page must not imply that a decoded token is authentic.
- Invalid token errors?
- Usually a truncated string, missing dots, or non-JSON after decode. Copy the token again without line breaks.