Decode a JSON Web Token to read its header and payload.
Paste a JSON Web Token above to decode its header and payload. A JWT is three base64url-encoded parts separated by dots — header, payload, and signature. This tool decodes the first two so you can inspect the claims inside, and formats any `iat`, `exp`, and `nbf` timestamps as readable dates.
Decoding happens entirely in your browser — the token is never sent anywhere. Note that decoding is not verification: it does not check the signature, so never trust a token’s contents without validating it server-side against the signing key.
No. It only decodes the header and payload so you can read the claims. Verifying the signature requires the signing secret or public key and must be done server-side; never trust a decoded token without validating it.
No. Decoding runs entirely in your browser with JavaScript, so the token never leaves your machine. It is still good practice not to paste production tokens into any online tool.