Does this verify that the token is authentic?

No - verifying a signature needs the issuer's secret or public key, which this tool never has. It only decodes the base64url-encoded header and payload; a token decoding successfully says nothing about whether it is genuine or was tampered with.

Does this tool send my token anywhere?

No - decoding runs entirely in your browser. Even so, treat real production tokens as sensitive and avoid pasting them into any tool unnecessarily.

JWT Decoder

Decode a JWT's header and payload - does not verify the signature.

Paste a JWT

This only decodes the token - it does not verify the signature. A token that decodes successfully is not necessarily authentic or untampered.

Files never leave your device - decoding runs entirely in your browser.

Related tools

How it works

1
Paste a JWT

The full token, including all three dot-separated parts.
2
See the decoded header and payload

Shown as formatted JSON.
3
Check the signature is present

Shown but not verified - see the note below.

FAQ

Does this verify that the token is authentic?: No - verifying a signature needs the issuer's secret or public key, which this tool never has. It only decodes the base64url-encoded header and payload; a token decoding successfully says nothing about whether it is genuine or was tampered with.
Does this tool send my token anywhere?: No - decoding runs entirely in your browser. Even so, treat real production tokens as sensitive and avoid pasting them into any tool unnecessarily.