Just Tool It
Just Tool It / JWT Decoder
On-device — nothing uploaded

JWT Decoder

Paste a JWT to inspect its header and payload. Tokens are decoded locally — never transmitted.

Header
Payload 

          

        

        

          Signature (Base64URL)
          

        

        

      


      

        

          
Why decode JWTs only in the browser?

          

            JWTs frequently embed user IDs, emails, roles, and sometimes overly permissive claims. Pasting a live access
            token into a random “JWT debugger” website is a common secret leak. This decoder base64url-parses header and
            payload locally so you can inspect claims without shipping the token to a third party. (Signature
            verification still requires the correct key — decoding ≠ trusting.)
          

        


        

          
How to decode a JWT safely

          
    
            
  1. 
              Paste the token (three base64url segments separated by dots).
            
    2. 
            
  2. View decoded header and payload as formatted JSON.
    3. 
            
  3. 
              Check exp, aud, iss, and custom claims for debugging.
            
    4. 
            
  4. 
              Clear the field when done; never commit tokens to tickets or chat.
            
    5. 
          

        


        

          
Frequently asked questions


          

            Does decoding verify the signature?
            

              Decoding only reads the payload. Anyone can decode a JWT. Verification needs the issuer’s secret or public
              key and should happen in your auth layer — not in a random website.
            

          


          

            Is my token uploaded?
            

              No. Parsing is pure client-side JavaScript. That is the point of this tool.
            

          


          

            What about encrypted JWTs (JWE)?
            

              This page targets signed JWT (JWS) inspection. Encrypted tokens need decryption keys you should not paste
              into untrusted tools.
            

          


          

            Can I encode JWTs here?
            

              Use the JWT Encoder tool for test tokens — and never use production secrets in the browser for real
              signing.
            

          

        


        

          
Related tools