▸ nex9.de
Home / Tools / JWT Decoder

JWT Decoder

Paste a JSON Web Token to instantly view its decoded header and payload. Decode-only — this tool never verifies signatures.

Header will appear here…
Payload will appear here…
Ad space

How to use this JWT decoder

Paste a JSON Web Token into the box above and click Decode (it also decodes automatically as you type or paste). The tool splits the token on its dots, base64url-decodes the header and payload segments, and pretty-prints both as JSON so you can inspect claims like sub, exp, or custom fields. Malformed tokens — wrong segment count, invalid base64, or unparsable JSON — are reported with a clear error instead of a crash.

Decoding is not the same as verifying

A JWT's header and payload are just base64url-encoded JSON — anyone can decode them without knowing the signing secret, which is exactly what this tool does. That means decoding tells you nothing about whether a token is authentic or has been tampered with; only checking its signature against the correct secret or public key does that, and that step has to happen on a server that holds the key, never in a browser tool like this one.

Privacy & security: This tool only decodes — it does not verify the signature, so a successfully decoded token is not proof that it's valid or untampered. Everything happens locally in your browser; the token you paste is never transmitted anywhere. Still, treat tokens with care: if a JWT contains sensitive claims, avoid pasting it into any tool, including this one, on a shared or untrusted machine.