JWT Decoder

A JSON Web Token is three base64url-encoded segments joined by dots: a header describing the signing algorithm and token type, a payload carrying the actual claims (like a user ID or expiration time), and a signature that ties the two together. This decoder splits the token on its dots, base64url-decodes the header and payload segments, and pretty-prints each as JSON — it does not touch the signature segment at all.

That last point matters more than it sounds: decoding a JWT and verifying a JWT are entirely different operations. Anyone can decode a JWT's header and payload without any secret, because base64url is an encoding, not encryption — the claims inside are readable by design, not confidential. Verifying that a token is authentic and hasn't been tampered with requires re-computing the signature with the issuer's secret or public key and comparing it to the signature segment, which this tool intentionally does not do, since that key is something only the issuing server should hold.

This is useful for debugging an auth flow — checking what claims and expiration a token actually carries, confirming a backend is issuing the fields you expect, or inspecting a token pasted from browser devtools — but it should never be treated as proof that a token is valid or unmodified.

A JWT has three base64url-encoded parts: header, payload and signature. Base64url is an encoding, not encryption, so anyone holding a token can read its claims.

This tool only decodes. It does not verify the signature, so a decoded token is not proof that the token is genuine. Signature verification must happen on your server with the right secret or public key. Tokens are decoded in your browser, but avoid pasting live production tokens into any tool you do not trust.