← All tools
JWT Decoder
Inspect a token's header and claims. Never verified server-side.
Why this exists
JWTs carry authentication claims between services — and when a login mysteriously fails, the answer is usually inside the token: expired, wrong audience, wrong issuer. Decode the header and claims locally.
🔒 Runs in your browser — nothing is sent anywhere
This decodes, it does not verify. Checking a signature needs the signing key, and pasting a signing key into a web page would be a bad idea. An unverified token tells you what it claims — not that the claim is true.
The decoded header, claims and signature appear here.