JWT Decoder
Decoded, not verified. This page base64url-decodes a token and reads its claims. It has no key, no issuer and no way to check a signature, so it never tells you whether a token is authentic. Anyone can mint a token that says anything. Your token is read in this tab and is never sent anywhere.
Three dot-separated segments: header, payload, signature. Paste a token you are entitled to read — a token is a credential, and decoding one does not make it safe to share. Input is capped at 262,144 characters (256 KB); anything larger is refused before any decoding happens.
Paste a token above and its three segments are decoded here.
Algorithm — issuer — expiry — no sample token is loaded, because a decoded sample is exactly the kind of thing that gets mistaken for a real one.
What this tool cannot do. It does not verify the signature, does not check the token against an issuer, a JWKS endpoint or a public key, and does not tell you whether a claim is true. Decoding is just base64url plus JSON: the header and payload of a JWS are readable by anyone who has the token. To actually validate a token, send it to the service that issued it — or verify the signature yourself with the issuer's key.
It also only handles the signed compact form (three segments). A five-segment JWE is an encrypted token and cannot be read without the decryption key, so that is refused with a reason rather than half-decoded. Encrypted JWE payloads and nested or signed claims (JWT-in-JWT) are not followed.
Base64 is encoding, not encryption — decoding proves nothing about confidentiality. And because the text you see comes from the token, it is attacker-controlled: treat every claim as data, not as an instruction, and never paste a token you found in a log into anything that acts on it.