JWT Decoder
Decode a JSON Web Token's header and payload instantly, entirely in your browser.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Decodes the header and payload only — this does not verify the signature (that needs the signing secret/key, which never leaves your server). Everything runs in your browser; nothing you paste is sent anywhere.
What is JWT Decoder?
Paste a JWT (JSON Web Token) and instantly see its decoded header and payload as readable JSON. This only decodes the token's Base64URL-encoded segments — it doesn't verify the signature, since that requires the secret or public key used to sign it.
FAQ
No. Verifying a signature requires the signing secret or public key, which should never be pasted into a browser tool. This decoder only reveals the header and payload, which are not encrypted, just encoded.
No — decoding happens entirely in your browser using standard Base64URL decoding. Nothing you paste leaves your device.
A valid JWT has exactly three dot-separated parts (header.payload.signature). If your string is missing a part or isn't Base64URL-encoded JSON, decoding will fail.