JWT Decoder

Paste a JSON Web Token to see its decoded header and payload, pretty-printed as JSON.

This tool only decodes the token, it does not verify the signature. No secret key is needed or checked, and nothing is sent anywhere, everything runs in your browser.

JWT

Header

—

Payload

—

Questions fréquentes

Does this tool verify the token's signature?

No. A JWT's header and payload are just base64url-encoded JSON, readable by anyone without any secret, this tool only decodes that part. Verifying the signature requires the issuer's secret or public key and is a separate, deliberately omitted step here.

Is it safe to paste a real production token here?

The decoding happens entirely in your browser using JavaScript, the token is never sent to a server. That said, as a general habit, avoid pasting live tokens (especially ones with sensitive claims) into any web tool, decode a sample or expired token when possible.

Why can anyone read a JWT's contents?

JWTs are signed, not encrypted, by design. The signature proves the token wasn't tampered with, but the payload itself is plainly visible to anyone who has the token. Never put secrets or sensitive personal data directly in a JWT payload.

Outils similaires

Formateur JSON Encodeur Base64 Décodeur Base64 Encodeur d'URL Décodeur d'URL Générateur de hash