JWT Decoder
Paste a JSON Web Token to inspect its header and payload claims. Decoding happens locally - the token never leaves your browser.
How to use
- Paste the full token (three dot-separated parts).
- Read the decoded header and payload as formatted JSON.
- Remember: decoding reads claims; it does not verify the signature.
Examples
Typical payload claims
Output: iss (issuer), sub (subject), exp (expiry, as a Unix timestamp), iat (issued at).
Frequently asked questions
Is it safe to paste a token here?
Decoding runs entirely in your browser, so the token is not transmitted. Still, treat tokens like passwords and prefer short-lived ones.
Does this verify the signature?
No. Verification requires the secret or public key and must happen server-side. This tool only decodes.