tool / 05
JWT Decoder
Paste a token to decode its header and payload. Decoding is local — nothing is ever sent anywhere.
Token
decoded locallyStatus
Header
Payload
Signature
Shown as-is, base64url encoded. This tool never verifies it — that needs the issuer's secret or public key, which never belongs in a browser tool.
Exports the decoded header, payload and expiry status only — never the raw token or signature, so the file is safe to share even when the token itself isn't.
Not a security check: anyone can craft a token with any claims. Trusting a JWT requires verifying its signature server-side with the issuer's key — this tool only shows you what's inside.