JWT Decoder
Paste a JSON Web Token to inspect its header and claims. Decoding happens entirely in the browser: the token is never sent anywhere, and signatures are not verified.
About JSON Web Tokens
A JWT is three base64url-encoded sections joined by dots: a header naming the signing algorithm, a payload of claims (who the token is for, when it expires), and a signature over the first two. The content is not encrypted, so anyone holding a token can read it, which is exactly what this tool does.
What the signature adds is tamper-proofing: without the signing key, nobody can alter claims and produce a valid signature. That is also why this tool does not verify. Verification needs the key, and a secret key should never be pasted into a website.
Decoding happens entirely in the browser and the token never leaves the page, which is worth knowing because a real token pasted into the wrong online decoder is a leaked credential.
Related tools
Case Converter
Convert text between UPPERCASE, camelCase, snake_case, kebab-case, slugs and more.
Whitespace & Line Tools
Trim whitespace, collapse spaces, dedupe and sort lines, remove line breaks.
Encode, Decode & Format
Format and minify JSON, encode and decode Base64, URLs and HTML entities.
Cron Expression Explainer
Type a cron schedule and get plain English, a field breakdown and the next run times.
Free and open source from Earthling Digital, an independent creative agency. Built with Earthling UI.