Loading page content
Paste a JWT and see the decoded header and payload plus whether it has expired. It runs entirely in your browser, which matters, because pasting a live token into a hosted decoder means handing someone your credentials.
Paste a JWT token to decode and inspect its header and payload. Shows algorithm, claims, and expiration status. Decoding happens entirely in your browser. Nothing is sent to any server.
A JWT is three Base64url segments: header, payload, signature. The first two are encoding, not encryption. Anyone holding the token can read every claim in it. Absorb that before you put anything sensitive in a payload, because a JWT in browser storage is a plaintext document to anyone who gets it.
Decoding is not verification. This tool shows you what the token says; it does not check the signature, which requires the secret or public key. A token can decode perfectly and still be forged. Verification belongs on your server, always.