All tools
Security & identity
JWT Decoder
Read the header and payload of a JSON Web Token.
Everything runs in your browser. Your data is never sent to a server.
Your token never leaves your browser; decoding happens entirely on your device.
What does the JWT Decoder tool do?
A JWT (JSON Web Token) is a token used for session and API authentication, made of three dot-separated parts: header, payload and signature. The first two are only Base64URL-encoded, not encrypted. This tool shows the header and payload as readable JSON.
What is it for?
- Checking the exp claim to see whether a token has expired
- Confirming that the user's role or ID is written into the token correctly
- Inspecting which alg value is used when debugging an authentication error
Things to keep in mind
- This tool does not verify the signature. Being able to read a token doesn't mean you can trust it; verification must always happen on the server with the secret key.
- Anyone can read the payload, so never put passwords or sensitive personal data in it.
Related tools
Want to talk about a project with the person who built these tools?
Get in touch