JWT Decoder
Decode a JSON Web Token to read its header and payload, in your browser.
Decoded in your browser; the signature is not verified. Do not paste live production tokens.
Learn JWT attacks in the Web Pentesting course →
Frequently asked questions
Does this JWT decoder verify the signature?
No - it only decodes the header and payload so you can read them. The signature is shown but not verified, and everything stays in your browser.
Is it safe to paste a token here?
The decoding is done locally in your browser and nothing is sent anywhere. Still, avoid pasting production tokens that are currently valid.