JWT Decoder
Decode a JWT's header and payload (signature is not verified).
Decodes the token locally; the signature is not verified.
Worth Knowing
A JSON Web Token looks like an opaque string but is really three base64url-encoded parts — header, payload, and signature — joined by dots, and the first two are trivially readable by anyone. That's the security lesson this tool makes visible: a JWT is signed, not encrypted, so you must never put secrets in the payload. The signature only proves the token wasn't tampered with; it doesn't hide the contents. Verifying that signature requires the secret key, which this decoder deliberately doesn't do.
How to Use
- Paste or type your jwt into the JWT Decoder above.
- The output updates instantly and is ready to copy.
- Decodes the token locally; the signature is not verified.