Inspect JSON Web Token headers and payloads for debugging OAuth and API sessions. This tool does not verify signatures—never trust decoded data alone in production.
JWT decoder
Inspect header and payload only. Signature is not verified and may be invalid.
Signature segment present (43 chars). Not verified.
How to use JWT decoder
- Paste a JWT (three dot-separated parts).
- Read the decoded header and payload JSON.
- Check expiry (exp) and issuer (iss) fields as needed.
Example: Developers use decoders to see why a token expired, not to validate trust.
Frequently asked questions
- Does this verify the token signature?
- No. It only decodes the readable header and payload. Signature verification must happen on your server with the signing key.
- Is it safe to paste a token here?
- Decoding happens locally in your browser, but treat real tokens as secrets and avoid pasting production tokens into any third-party tool.