Paste a JSON Web Token to instantly view its decoded header and payload claims — entirely in your browser.
No, this tool only decodes and displays the header and payload — it doesn't verify the signature, which requires the secret or public key used to sign the token.
Decoding happens entirely in your browser and the token is never sent to a server, but as a general precaution avoid pasting tokens with highly sensitive production data into any tool.
JWTs are Base64-URL encoded, not encrypted — this is by design, since JWTs are meant to be readable but tamper-evident via their signature, not confidential.
This tool decodes a JSON Web Token (JWT) and displays its header and payload as readable JSON, entirely in your browser. It's useful for debugging authentication issues, inspecting token claims, and understanding what data a JWT actually contains.
A JWT consists of three parts separated by dots: a header, a payload, and a signature. The header typically specifies the signing algorithm and token type. The payload contains the actual claims — data like user ID, expiration time, and any custom fields the issuer included. The signature is a cryptographic hash that lets the receiving system verify the token hasn't been tampered with, provided they have the correct secret or public key.
A common misconception is that JWTs are encrypted. They're not — the header and payload are simply Base64-URL encoded, which is a reversible text encoding, not encryption. Anyone who has a JWT can decode its header and payload instantly, exactly as this tool demonstrates. This is by design: JWTs are meant to be tamper-evident (via the signature) rather than confidential. Sensitive data that shouldn't be readable by anyone holding the token should never be placed in a JWT payload.
Verifying a JWT's signature requires the same secret key (for HMAC algorithms like HS256) or the corresponding public key (for RSA/ECDSA algorithms like RS256) that was used to sign it — information that only the issuing server should have. Since this tool has no access to that secret, and receiving it would defeat the purpose of keeping it secret, this tool intentionally only decodes and displays the token's contents without claiming to verify its authenticity.
All decoding happens directly in your browser using JavaScript's built-in Base64 decoding — your token is never sent to a server.