JWT Decoder
Decode a JSON Web Token to read its header and payload without needing the secret.
Reading what's inside a token
A JWT is three Base64 parts separated by dots — a header, a payload of claims, and a signature. The header and payload are only encoded, not encrypted, so anyone can read them. This decodes those parts so you can see the claims inside a token: who it is for, when it expires, what permissions it carries — invaluable when debugging authentication.
Paste the token and its header and payload are decoded and laid out.
Decoding is not verifying
A critical point for anyone working with JWTs: reading a token is not the same as trusting it. The signature is what proves a token is genuine and unaltered, and verifying it requires the secret or public key — decoding alone tells you what a token claims, not whether those claims are legitimate. Never make a security decision based on a decoded payload without verifying the signature. And because the payload is readable by anyone, never put secrets in it.
JWT Decoder FAQ
Do I need the secret to decode a JWT?
No — the header and payload are only Base64-encoded, so anyone can read them. The secret is only needed to verify the signature.
Does decoding prove the token is valid?
No. Decoding shows what a token claims; only verifying the signature proves it is genuine and unaltered.
Is my token uploaded?
No. It is decoded in your browser, which matters since tokens are sensitive.