Does this tool verify the JWT signature?

No. Decoding shows the token's contents but anyone can craft a token with any payload. To verify, you must validate the signature against the issuer's secret or public key on a trusted server.

What algorithms are supported?

Decoding is algorithm-agnostic — it just Base64URL-decodes the header and payload. Verification (which we don't do) would require knowing the algorithm specified in the header.

Why does my payload show 'not JSON'?

The header and payload should be JSON. If they're not, the tool still shows the raw decoded text with a small 'not JSON' badge — this can happen with malformed or custom tokens.

Can I decode tokens with no signature?

Yes. If the third part is missing, the signature shows '(none)'. Unsigned tokens (alg: none) are insecure and should never be trusted for authentication.

Are my tokens uploaded?

No. Decoding happens entirely in your browser. Still, avoid pasting production access tokens into any web tool — use a local script if possible.

JWT Decoder

Inspect JWT header and payload — no signature verification.

100% private — no uploads Developer ToolsFree & unlimited Read tutorial

See how it works

Watch a quick simulation of this tool in action — no file needed.

How to use JWT Decoder

Follow these steps — everything happens instantly in your browser.

1
Step 1. Paste your JWT (three dot-separated Base64URL parts).
2
Step 2. The header and payload are decoded and pretty-printed automatically.
3
Step 3. Copy either section or the signature as needed.
4
Step 4. Remember: this only decodes — never trust claims without verifying the signature.