Is it safe to decode JWT tokens here?

Yes. JWT payloads are Base64-encoded (not encrypted) — they're meant to be readable. We only decode the public parts. Never share tokens that are still valid for production systems.

Can this verify the signature?

No. Signature verification requires the secret key or public key, which should never be shared publicly. This tool only decodes the header and payload.

JWT Decoder

Decode and inspect JSON Web Tokens (JWT). View the header, payload, and verify token structure without any external tools.

Input

About JWT Decoder

Decode JWT header and payload locally. Use this to inspect claims, expiry, and algorithm — without sending tokens to a third party. Never paste production secrets or still-valid access tokens you cannot rotate.

How to use

Paste a JWT (three Base64URL segments separated by dots).
Review decoded header and payload.
Check exp/iat timestamps and custom claims.

Frequently Asked Questions about JWT Decoder

Feedback