Read the header and payload inside any token — decoded only, never verified.
Decodes only. This tool never verifies the signature, and you should never paste a real production token here.
Results update instantly as you type.
No. This tool decodes only and never verifies the signature. A decoded payload proves nothing about who issued the token — only a real signature check with the correct key can do that.
A JWT has a header, a payload and a signature, separated by dots. The header names the algorithm, the payload holds the claims, and the signature is meant to prove the token was not tampered with.
Because anyone holding your token can act as you until it expires. Only decode test tokens, and treat any real token like a password.
Yes — 100% free, no sign-up, no limits. Everything runs in your browser; none of your numbers are uploaded or saved.