🪪 JWT Decoder
Paste a token to see its header and payload. This only decodes — it does not verify the signature, so never treat a decoded token as proof it's genuine.
Anyone can decode a JWT's contents without the secret key — that's by design, JWTs aren't encrypted.
Never paste a token from a production system you don't control, and this tool never sends the token
anywhere; decoding happens entirely in your browser.