JWT decoder
Inspect a JWT header and payload locally. This tool does not verify signatures or decide whether a token is valid.
Decoding does not verify the signature, issuer, audience or expiry. The example has a dummy signature. Never use this output as proof of identity.
What the output means
The decoder reads three-part compact JWTs, including unsecured tokens. It checks base64url and JSON encoding, but does not trust any claim or fetch a key. Five-part encrypted JWE tokens and opaque tokens cannot be decoded here.
A decoded exp, iss, aud or role is unverified input. Resource servers must validate the token and apply their own access policy; see tokens and resource servers. JWT serialization is defined in RFC 7519.
The example contains a dummy signature and cannot authenticate a request. Your input stays in this tab's memory: no upload, URL sharing or browser storage. Clear it or leave the page when finished.