JWT Decoder
Paste a JWT to decode its header and payload on the spot. Everything runs in your browser — the token is never sent anywhere.
This does not verify the signature (that requires the secret or public key). A JWT's payload is readable by anyone, so never put passwords or other secrets in one.
Enter a JWT to get started.
Header
Payload
When this comes in handy
Handy when you want to quickly inspect a JWT (access token or ID token) returned by an API. The header and payload are formatted instantly, and you can see at a glance whether exp (the expiry) has passed.