JWT Decoder
Read the header and payload. The signature is not verified.
Ctrl+Enter runs. Ctrl+Shift+Backspace clears.
Decoding does not verify the signature. The token is not sent anywhere.
Export and import are available after you sign in. Sign in
Decoding does not mean the token is trusted. Nothing is sent to an API. Do not paste secrets you would not show on screen.
About this tool
Inspect an access token while debugging authentication. Paste the JWT to see the header, the payload claims such as sub, exp and iat, and the signing algorithm.
How to use it
- 01
Paste the JWT.
- 02
Read the decoded header and payload.
- 03
Check claims such as exp and the algorithm.
Frequently asked questions
Does it verify the signature?
No. Decoding shows what the token says; it does not prove the token is genuine or trusted.
Is it safe to paste a real token?
The token is decoded in your browser and never sent anywhere, but treat it like a password and avoid sharing your screen.