JWT Decoder

Paste a JSON Web Token to see its decoded header and payload.

How to use JWT Decoder

Paste your JWT into the box.
The decoded header and payload appear as formatted JSON, along with the raw signature.
Copy any section with its own copy button.

→ sign a new token with your own secret

Reference: RFC 7519, the JSON Web Token spec

Frequently asked questions

Does this verify the token's signature?

No — it only decodes the header and payload, which are just Base64-encoded JSON, not encrypted. Verifying the signature requires the secret or public key the token was signed with, which this tool never has access to.

Is it safe to paste a real JWT here?

Decoding happens entirely in your browser — the token is never sent anywhere. That said, treat access tokens as sensitive regardless of where you paste them, since anyone who has the raw token can already read its payload without any tool.

Why can I read the payload without a password?

Because a JWT isn't encrypted — it's signed. Signing proves the payload hasn't been tampered with; it doesn't hide the contents, which is why JWTs shouldn't carry secrets like passwords in their payload.

Community

Related tools

JSON Formatter

Format, validate, and beautify JSON with syntax highlighting.

Base64 Encoder / Decoder

Encode and decode Base64 strings instantly.

URL Encoder / Decoder

Encode or decode URL/percent-encoded strings.

HTML Encoder / Decoder

Convert special characters to HTML entities and back.