How to use it
Paste a compact three-part JWT and select Decode. The decoded header and payload are displayed as JSON, and the encoded signature is shown separately.
THE TOOLBOX / SECURITY UTILITIES
Look inside
your token.
Inspect a JWT header and payload in your browser. Decoding is for debugging; it does not establish trust.
Decoded only — not verified.
Signature, issuer, audience, and claims are not verified. Do not use this output to authenticate or authorize anyone. Avoid pasting real tokens on shared devices.
● Processed in your browser
Paste a token to inspect its contents.
THE DETAILS
Know what you’re looking at.
Decoding is not verification
Anyone can create or modify claims. This tool does not verify the signature, issuer, audience, expiration, or any other claims. Never use the result for authentication or authorization.
Dates and supported tokens
Numeric exp, nbf, and iat claims are displayed as UTC and device-local dates when possible. Encrypted JWTs (JWE), nested tokens and unencoded payloads are not supported.
Privacy
Decoding happens in your browser; the token is not intentionally sent or saved. JWTs can contain credentials or sensitive information, so avoid using real tokens on shared or untrusted devices.