JWT Decoder

Paste your JWT

Invalid JWT format — a JWT should have three parts separated by dots.

Header

—

Payload

—

What is a JWT?

A JSON Web Token (JWT) is a compact, encoded string used to securely pass information — commonly for authentication — between a client and server. It consists of three parts separated by dots: a header, a payload, and a signature.

The header and payload are Base64Url-encoded JSON, which means anyone can decode and read them without needing the secret key — this tool simply reverses that encoding to show the readable content. The signature, however, can only be verified with the correct secret key, which this tool does not attempt to check.

Important note on security

Decoding a JWT does not verify it. A decoded token might look valid but could have been tampered with if the signature isn't properly checked. Never trust a JWT's contents in a production system without verifying its signature server-side. This tool is for inspecting and debugging tokens, not for authentication decisions.