JWT Decoder
Decode JWT tokens safely in your browser. Inspect headers and payloads without sacrificing privacy.
Privacy Guaranteed
Your JWT token is decoded locally in your browser and is not uploaded anywhere.
Features
- Client-Side Decoding: Decodes tokens directly in your browser. Your sensitive JWT never hits a backend server.
- Organized Layout: Visually separates the Header, Payload, and Signature into distinct color-coded panels for easy reading.
- Instant Parsing: Paste your token and see the decoded JSON objects instantly.
- Unicode Support: Properly decodes JWTs containing non-ASCII unicode characters inside the payload.
How it works
A JSON Web Token (JWT) is composed of three parts separated by dots (.): a Header, a Payload, and a Signature. Both the Header and Payload are Base64Url encoded JSON objects. This tool simply splits the token by the dots, decodes the Base64Url strings back into JSON, and displays them nicely formatted. Because it only decodes, it does not verify the cryptographic signature.
Frequently Asked Questions
Everything you need to know about DevToolkit.
Is it safe to paste my production JWT here?
Yes! The entire decoding process happens via JavaScript running on your own machine. We do not store, log, or transmit your tokens anywhere. However, it's always best practice to treat production tokens with care.
Can this tool verify my JWT signature?
No. Verifying a JWT signature requires the secret key (for HMAC) or the public key (for RSA/ECDSA). Since we don't ask for your secret keys (and you shouldn't give them to web tools!), we only decode the contents.
Why does my token fail to decode?
Ensure you copied the entire token without any missing characters or extra spaces. A valid token will always have two periods separating three distinct Base64Url strings.