>_toolkitbox
JAENESPTFR

~/tools / JWT Decoder

JWT Decoder

Decode a JWT (JSON Web Token)'s header and payload. Signature verification is not performed (it requires the secret key). Processed entirely in your browser.

A JWT is a token made of 3 dot-separated parts commonly used for authentication. The header and payload are only Base64URL-encoded, not encrypted, so this tool lets you peek inside a token you received after login.

# Use Cases

  • Checking what's inside an access token you just received — expiry, claims, etc.
  • Debugging an auth issue by confirming a token actually contains the claim you expect
  • Quickly understanding the structure of a JWT returned by a third-party API

# Usage

  1. Paste the JWT string you want to decode into the box.
  2. Click "Decode" to see the HEADER (algorithm, etc.) and PAYLOAD (claims) as formatted JSON.
  3. The signature is not verified. To check for tampering, verify it on the issuing server.

# FAQ

Can this verify the signature?
No, this tool is decode-only. Signature verification requires the issuer's secret/public key, so it's intentionally not supported here — use it just to inspect a token's contents.
Is my token sent anywhere?
No. Base64URL decoding happens entirely in your browser's JavaScript — nothing is sent to a server. That said, avoid pasting production tokens into arbitrary tools more than necessary.

# Related

Base64 Encoder/DecoderHash Generator

# Learn more on our sister sites