JWT Decoder

Read the header and claims of a JSON Web Token. Nothing is sent anywhere.

This decodes a token; it does not verify one. A JWT's payload is only Base64, not encryption, so anyone holding the token can read every claim in it. Treat the contents as readable by whoever has the token, and never put a secret in one.

This runs entirely in your browser. Nothing you type here is sent to the server, logged, or leaves your machine.