JWT Decoder
Decode JWT header, payload and signature — entirely client-side.
Three steps, no reading required.
Paste your input
Drop text, code, or data into the input pane — from an API response, a file, anywhere.
See it process
The result updates instantly as you type.
Copy the result
Grab the output with Copy, or fix the error shown if the input is invalid.
Try it with a sample.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkRldlV0aWxzTm93IiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Upload & hope
- Sends your input to a server to process it
- Asks for an account after a few free uses
- Limits input size on the free tier
Runs where you are
- Processes everything inside your browser tab
- No account, ever
- No artificial size limit
Questions worth answering upfront.
No. The JWT is decoded entirely in your browser. Your token is never uploaded, logged or stored — important, since tokens are sensitive credentials.
No. This is a decoder, not a verifier. It reads the header and payload but does not check the signature against a secret, because that would require sharing your secret.
A JWT has a header (algorithm and token type), a payload (the claims), and a signature — each Base64URL-encoded and separated by dots.
Decoding is safe because it stays in your browser, but a JWT is still a credential. Avoid sharing tokens in screenshots or with others, and prefer expired or test tokens where possible.
People who use this also reach for
Guides that pair with this tool
Need another tool?
36+ browser-based utilities — all free, all private, nothing to install.