ToolsLodge

JWT Decoder

Inspect the contents of a JSON Web Token.

Runs in your browserFree

Decoding does not verify a token's signature or make its claims trustworthy. Treat JWTs as sensitive credentials.

Decode a compact JWT with a Base64URL header and payload. The token stays in your browser.

No token decoded yet.

How to use

  1. Paste a compact JWT into the input, or choose Load sample.
  2. Choose Decode token or press Ctrl+Enter (or Command+Enter on macOS).
  3. Inspect the decoded header, payload, and encoded signature.
  4. Choose Copy result to copy the decoded JSON, or Clear to remove the token and result.

About this JWT decoder

JSON Web Tokens (JWTs) are compact strings commonly used to carry signed claims between systems. A compact token has three dot-separated parts: a Base64URL-encoded header, a Base64URL-encoded payload, and a signature. This tool decodes the first two parts as JSON and displays all three parts for inspection.

Decoding is not verification. Anyone can create or change an unsigned token, and the displayed claims must not be trusted based on this tool’s output. The tool does not verify signatures, check expiration, validate issuer or audience, or determine whether the token is authentic.

Privacy

The token is processed entirely in your browser and is not uploaded or saved by ToolsLodge. JWTs can contain sensitive claims or function as bearer credentials, so treat them as secrets and avoid pasting production tokens into shared devices.

Frequently asked questions

Does this JWT decoder verify the token signature?

No. It only decodes the header and payload and displays the encoded signature. It does not verify the signature, validate claims, or establish that a token is trusted.

Is my token uploaded or stored?

No. Decoding happens locally in your browser. ToolsLodge does not upload or save your input.

Can I decode an expired token?

Yes. This tool displays the token contents as-is and does not check the expiration or any other claim.

Is it safe to share a JWT?

Not necessarily. A JWT may be a bearer credential. Treat tokens as sensitive even though this tool processes them locally, and avoid pasting production credentials into shared devices.

Base64 Encode/Decode

Encode text to Base64 or decode Base64 back to text.

JSON Formatter and Validator

Format and validate JSON with clear indentation.

Hash Generator

Create a SHA hash from text in your browser.