ready — local
JWT Decoder
Paste a token to see its header and payload. Decoding happens in this tab only — a JWT often carries session data, so it's never sent anywhere.
—
—
Signature is not verified here — this tool only decodes, it doesn't check whether the token is valid.
How this works
A JWT is three Base64URL-encoded sections separated by dots: header, payload, and signature. This tool splits the token on those dots and decodes the first two sections back into readable JSON directly in JavaScript. The signature section is cryptographic and isn't decoded, since its job is verification, not storage.
Common uses
Checking why a login session isn't behaving as expected, inspecting what claims an API is issuing, or confirming an expiry timestamp during debugging.