Runs locally in your browser. Nothing you enter is uploaded to our servers.
Result will appear here
Tips for decoding JWTs
Decoding is not verification — signatures are not checked here.
Do not paste production tokens with live secrets into random tools.
Inspect exp, nbf, and aud before trusting claims in your app.
Header alg matters — reject unexpected algorithms server-side.
Treat payload data as readable by anyone holding the token.
Read a JWT without verifying it
Processing stays in your browser — your input is not uploaded to our servers.
A JWT is three Base64url parts: header, payload, signature. Decoding shows claims like `sub`, `exp`, and `alg` — it does not prove the signature is valid.
Paste access tokens you already have in DevTools. Treat the payload as readable by anyone who holds the token.
Decode a JWT
Paste the token
The three segments separated by dots. Extra whitespace usually breaks the payload.
Read header and claims
Check `alg`, expiry, and audience. `alg: none` or unexpected issuers are red flags.
Clear the field
Tokens are credentials. Do not leave them in a shared screenshot.
JWT decode FAQ
Does decode mean the token is valid?
No. Decode only reads JSON. Use JWT validate when you have the key and want a signature check.
Is the token sent to a server?
No. Decoding is local. You are still looking at a secret — do not paste production tokens on a shared machine.
Why is the payload readable without a key?
JWTs are signed, not encrypted, unless you use JWE. Anyone with the token can read claims.