JWT Encoder / Decoder
Paste a JWT to read its header, payload, and signature segment in your browser. No token leaves this page, and no security claim is made about the signature.
A QUICK WALKTHROUGH
How to use this tool
- Paste a compact JWT with three dot-separated segments.
- Decode the header and payload locally.
- Review the signature segment and algorithm metadata without treating the token as verified.
What a compact JWT contains
A compact JSON Web Token has three Base64URL segments: a header, a payload, and a signature. This tool decodes the first two segments and shows useful facts about the third.
Decoding is not verification
Anyone can read a JWT payload. A decoded token may be expired, altered, or untrusted. This page does not check a key, validate claims, verify a signature, or make a token.
Local and ephemeral
Parsing happens entirely in your browser. The token is not uploaded or stored by this tool; avoid pasting live credentials into shared or recorded screens.
GOOD TO KNOW
Common questions
Does this verify the JWT signature?
No. It only decodes the header and payload and reports opaque signature metadata. Use your application’s trusted verification code before accepting a token.
Can I decode an encrypted JWT?
No. Encrypted JWTs (JWE) use a different five-segment compact form and require the correct decryption key. This tool expects a three-segment signed JWT.
Does decoding prove the token is safe?
No. Decoding is for inspection only. Check issuer, audience, expiry, signature, and application-specific claims with trusted server-side logic.
Does my token leave the browser?
No. The page performs its parsing locally and does not send the token to a server.