JWT Decoder

Paste a JSON Web Token to read its header, payload and claims, then optionally verify its signature.

Encoded token

Tokens are decoded in your browser and never stored.

Verify signature

Secret or public key

Secret is Base64 encoded

HEADER

PAYLOAD

CLAIMS

Decoding is not verifying

Anyone can read a JWT, because the header and payload are only Base64URL encoded. What makes a token trustworthy is its signature, so always verify it on your server before acting on the claims. Read the full guide to learn what each claim means.