← All tools
🪪 JWT Decoder
Reads header and payload only. Does not check the signature. Never paste a live production token you care about.
FAQ
Does this verify the signature?
No. It only Base64-decodes header and payload. Treat the token as untrusted.
Should I paste a live production JWT?
Avoid it. Anyone with the token can often act as that user until it expires.
Why is the payload garbled?
The token is not three Base64URL parts, or the payload is not JSON.