JWT Decoder

This tool decodes a JSON Web Token, or JWT, so you can read what is inside it, splitting it into its header and payload and showing the claims in readable form. JSON Web Tokens are the standard way modern web applications carry identity and authorisation information between a server and a client. After you log in, the server often issues a JWT that your browser sends back with each request to prove who you are. A token is three parts separated by dots: a header describing the algorithm, a payload containing the claims such as the user ID and an expiry time, and a signature that lets the server confirm the token has not been tampered with. The header and payload are simply Base64url-encoded JSON, not encrypted, so anyone can read them, which is exactly what this tool does. You paste a token, and the calculator decodes the header and payload and displays the JSON neatly, so you can inspect the claims, check the expiry, or debug an authentication problem. Everything runs in your browser and nothing is uploaded, which matters because tokens often grant access and should not be shared. The result updates as you paste. Use it to debug login and API issues, to read the claims a token carries, or to learn how JWTs are structured. Two important points: this tool decodes but does not verify the signature, since that requires the secret or public key held by the server, so a decoded token is not a validated one. And because the payload is only encoded, never put secrets in a JWT, as anyone holding the token can read them.

Decodes the header and payload only. The signature is NOT verified, so a decoded token is not validated. Never put secrets in a JWT; the payload is readable by anyone.