Is it safe to paste a token?

Only paste tokens you are allowed to inspect, and avoid live production tokens where possible. Anything you submit is used to produce the decoded result.

Does this verify the signature?

No. It only decodes the Base64URL-encoded header and payload. Always verify the signature and claims on the server before trusting a token.

What are the three JWT parts?

Header, payload, and signature, separated by dots. The first two are readable by anyone who has the token.

English

English Español हिन्दी Français Deutsch Português

Developer

JWT Decoder

Decode a JSON Web Token header and payload.

Free · no sign-up Instant results Nothing stored

Use this tool →How it works ↓

Ready when you are

Run JWT Decoder

Free to use · No signup required

Input

Result

Output appears hereFill in the fields, run the tool, and the result shows up right here with a one-click copy button.

About this tool

JWT Decoder

Inspect the header and payload of a JSON Web Token without sending it anywhere. Decoding is not verification: always validate the signature before trusting a token.