JWT Decoder
Decodes the header and payload of a JSON Web Token. This reads the contents — it does not check the signature.
Sponsor
Decoding ≠ verification. Anyone can decode a JWT without a key — that's by design, the payload isn't secret. A decoded token tells you what it claims, not whether it's genuine. Only signature verification with the correct key confirms that. Don't trust claims from a token you haven't verified.
Tool 03 — decode (not verify)
Idle
Token0 chars
Header
Payload
FAQ
How do I decode a JWT token?
Paste the full token — three dot-separated parts — into the input. The header and payload decode automatically as formatted JSON.
Can you decode a JWT without the secret?
Yes. The header and payload are Base64url-encoded JSON, readable with no key at all. Only the signature requires the secret or public key, and this tool doesn't check it.
Is decoding a JWT the same as verifying it?
No. Decoding shows you the claims. Verifying confirms they're genuine and unaltered. Treat an unverified token's claims as untrusted input.
Related tools