Decode and inspect JSON Web Tokens (JWT) — see the header and payload safely in your browser without sending the token anywhere.
This tool runs entirely in your browser — no data is sent to our servers. If JavaScript is disabled, the fully interactive version will not run; enable JavaScript to compute results.
A JWT is three Base64url-encoded segments separated by dots: header, payload and signature. The header describes the algorithm used to sign the token. The payload contains the claims (who the user is, when the token expires, what they can access). The signature proves the token was issued by a trusted party and has not been modified.
The decoder reveals what is in the header and payload but does NOT verify the signature — verification needs the secret key (for HS256) or the public key (for RS256, ES256). Decoded but unverified payload should never be trusted for authorization decisions in production; this tool is for debugging only.
JWTs are a common authentication token in modern web apps. Knowing how to inspect one is essential for debugging auth flows, checking expiry, and confirming what claims your service is receiving.
No. Verification requires the secret (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms). The decoder shows the signature but does not validate it.
No. Decoding runs entirely in your browser using JavaScript atob() function. The token stays on your device.
JWT is the data structure. JWS (JSON Web Signature) is the format for signed tokens — the common case. JWE (JSON Web Encryption) is the format for encrypted tokens, where the payload is hidden from anyone without the key.
The JWT Decoder lives alongside Base64 Converter, HTML Code Compiler, JSON Formatter & Validator on the Developer page. That landing page collects every developer tool Dailiyo publishes, plus the editorial notes on formula sources, review cadence and how each result should (and should not) be interpreted. If a related developer calculation isn't yet in the collection and you'd like to see it, drop a line via the contact page — the editorial team reviews every request and prioritises tools that come up most often in reader questions.