Paste a JWT below to decode its header and payload. This tool only decodes — it does not verify the signature.
About this tool
Decodes a JSON Web Token's header and payload so you can inspect its claims — useful when debugging an auth flow. This tool only decodes; it does not verify the signature, so a decoded token should never be treated as proof of authenticity.
Frequently asked questions
Why doesn't this tool verify the signature?
Verifying a signature requires the secret key or public key the token was signed with — something this tool deliberately never asks for, since pasting a signing secret into any web tool is a bad practice regardless of how trustworthy the tool claims to be.
Is it safe to paste a real production JWT here?
The token is decoded entirely in your browser and never transmitted, so it's technically safe from a network standpoint — but as general practice, avoid pasting live tokens (especially ones with long expiries) into any tool, and prefer a short-lived test token when debugging.