Index / Developer
JWT Decoder
Paste a JSON Web Token to read its header and claims.
This token does not leave your browser.
The page has no network code, and the site's content security policy sets
connect-src 'none', so it could not send the token anywhere
even if it tried. The token is deliberately kept out of the URL as well,
so it cannot end up in your history, a bookmark or a referrer header.
A JWT usually is a live credential. Treat it like one.
Token
Three base64url segments separated by dots.
Waiting for a token
--
Algorithm
--
Claims
0
Header
--
Payload
--
Registered claims
On the signature
The signature is shown but not verified. Verifying it requires the
secret or public key that signed the token, and a decoded token proves
nothing about authenticity on its own. Anyone can craft a token whose
payload says whatever they like — only the signature check, done
on your server against a key you control, makes it mean anything.