Use JWT Decoder - free
Frequently asked questions
Does this verify the token’s signature?
No, verifying a signature requires the secret (HMAC) or public key (RSA/ECDSA) used to sign it - this tool only decodes the publicly visible header and payload.
Is my token sent to a server?
No, decoding happens entirely in your browser using standard Base64URL decoding - nothing is transmitted.
Why would decoding fail?
If the pasted text isn’t a valid JWT (three dot-separated Base64URL-encoded parts) or the payload isn’t valid JSON, decoding will show a clear error.