JWT Decoder
Paste a JWT to read what's inside it, the header and the data (payload). Runs entirely in your browser; your token is never uploaded.
This tool only reads the token, it does not check the signature, so a decoded token isn't proof it's genuine. Because it all happens in your browser, your token is never sent anywhere.
A JWT (JSON Web Token) is a compact token that apps use to carry sign-in and identity data. This tool decodes one so you can read what's inside, the header and the data (payload), right in your browser.
How to use
- Paste your token into the box.
- Tap Decode.
- Read the header and payload; any date fields (like when it expires) are shown in plain form.
Frequently asked questions
Does this check if the token is valid?
No. It only reads (decodes) the contents, it does not verify the signature. A decoded token is not proof that it's genuine or unexpired.
Is it safe to paste my token here?
The decoding happens entirely in your browser and your token is never uploaded. Still, treat real tokens as secrets and avoid pasting production tokens into any tool you don't control.
What are the three parts?
A JWT has a header, a payload (the data), and a signature, separated by dots. This tool shows the first two in readable form.