Decode a JWT
Inspect the header and payload of a JSON Web Token. Nothing is transmitted, which matters — tokens are credentials.
What to know
The header and payload are Base64URL-decoded and pretty-printed. The signature is shown as-is and deliberately not verified — verification needs the secret or public key, and pasting a signing secret into a web page would be a far worse idea than the problem it solves.
This is the tool where running locally matters most. A JWT is a live credential; anyone holding it can usually act as the user it identifies. Pasting one into a server-side decoder hands your session to a stranger.
Questions
Is anything uploaded to a server?
No. Every tool on this site runs inside your browser using standard web APIs. There is no upload, no account, no logging and no server holding your data afterwards. You can confirm it by opening your browser's developer tools and watching the network tab stay empty while you work.
Does this verify the signature?
No, and deliberately so. Verification requires the signing key, and sending that anywhere is exactly the risk this tool exists to avoid. Decoding shows you the claims; verification belongs in your backend.
Is it safe to paste a real token here?
The token never leaves your browser — there is no network request. That said, treat any token you have pasted into any tool as worth rotating if you cannot verify that claim yourself. You can verify it here by watching the network tab.