Skip to main content
Tools Star Hub
Developer Tools category

JWT Decoder

Decode a JSON Web Token header and payload in your browser. The signature is not checked.

What is JWT Decoder?

A JWT decoder reads the header and payload of a compact JSON Web Token in your browser. Decoding does not verify the signature or prove the token is authentic.

Loading tool…

This tool runs in your browser. Inputs, files and generated values stay on this device. Favorites and recently used tools, if you use them, store only tool names in local storage — never passwords, documents or QR contents. See the privacy policy.

JWT Decoder — Read a Token Header and Payload — Tools Star Hub

What this tool does

Read the header and payload of one compact JSON Web Token. The signature is not checked.

How to use

  1. Paste a compact token with sections separated by dots.
  2. Press Decode.

Examples

  • A three-part token

    The first part is the header, the second is the payload, and the third is an unchecked signature section.

Main features

  • Decoded header JSON.
  • Decoded payload JSON.
  • A note that says whether a signature section is present.

How it works

The page splits the token on dots and decodes the header and payload from base64url as UTF-8 JSON. A signature section can be reported as present or empty. It is never described as valid or invalid, because this page does not verify it.

Tips

  • Paste the token only in this page.
  • Treat a decoded payload as untrusted until a verifier checks the signature.

Limitations

Decoding does not prove that a token is authentic. The page does not fetch a signing key.

See the disclaimer for what these tools do not cover.

FAQ

What does a JWT decoder show?
It shows the header JSON and the payload JSON. It also says whether a signature section is present.
Does decoding prove the token is authentic?
No. Decoding a JWT does not verify its signature or prove that the token is authentic.
Is the token sent to a server?
No. Decoding happens in your browser. The token is not saved or added to the page address.
What if the signature section is empty?
The page says the section is present and empty. It still does not call the token valid or invalid.
What if a section is not JSON?
The page rejects that token instead of showing a partial guess.

Related tools

Helpful guides

Guide

What Base64 Is, and How to Encode Text

Encode text to Base64 after UTF-8, or decode it back. The result is not encryption.

Read guide

Guide

How to Read a JWT Without Treating It as Verified

How to read a JWT header and payload, and why that does not verify the signature.

Read guide