Can anyone decode my JWT?

Yes. JWT payloads are only Base64URL-encoded, not encrypted. Anyone with the token can read the claims. Never store passwords or sensitive PII in JWT payloads.

Does decoding verify the token?

No. Decoding reads the contents without checking the signature. Only verification with your secret or public key proves authenticity.

Is it safe to paste tokens here?

Decoding runs entirely in your browser. No data is sent to a server. Avoid pasting production tokens on untrusted machines.

Can you decode a JWT without a secret?

Yes. JWT payloads are Base64URL-encoded, not encrypted. Anyone with the token string can read claims. Decoding does not prove the token is authentic — verification requires the secret or public key.

Is decoding a JWT the same as verifying it?

No. Decoding only reads header and payload. Verification checks the cryptographic signature and typically validates exp and other claims. Never authorize requests based on decode alone.

Herramienta

Decodificador JWT

Inspecciona el header y el payload del JWT en local — nada se envía a un servidor.

Last updated July 1, 2026

Se ejecuta por completo en tu navegador — no se envían datos a servidores. Política de privacidad

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Los controles de la herramienta permanecen en inglés por precisión. La generación no sale de tu navegador.

JWT token

Secret (optional — HS256 verification only)

Paste a token and click "Decode JWT" to view the header and payload.

Decoding does not verify authenticity. For full validation, use the JWT Validator. All processing is client-side.

CLI equivalents (decode without verify)

node -e "(async()=>{const {decodeJwt}=await import('jose');console.log(JSON.stringify(decodeJwt(process.argv[1]),null,2))})()" -- "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig"

Página completa en inglés con guías y preguntas frecuentes