Can anyone decode my JWT?

Yes. JWT payloads are only Base64URL-encoded, not encrypted. Anyone with the token can read the claims. Never store passwords or sensitive PII in JWT payloads.

Does decoding verify the token?

No. Decoding reads the contents without checking the signature. Only verification with your secret or public key proves authenticity.

Is it safe to paste tokens here?

Decoding runs entirely in your browser. No data is sent to a server. Avoid pasting production tokens on untrusted machines.

Can you decode a JWT without a secret?

Yes. JWT payloads are Base64URL-encoded, not encrypted. Anyone with the token string can read claims. Decoding does not prove the token is authentic — verification requires the secret or public key.

Is decoding a JWT the same as verifying it?

No. Decoding only reads header and payload. Verification checks the cryptographic signature and typically validates exp and other claims. Never authorize requests based on decode alone.

Tool

JWT Decoder

Decode JWT header and payload without a secret. Inspect claims and expiration client-side.

Last updated July 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

JWT token

Secret (optional — HS256 verification only)

Paste a token and click "Decode JWT" to view the header and payload.

Decoding does not verify authenticity. For full validation, use the JWT Validator. All processing is client-side.

CLI equivalents (decode without verify)

node -e "(async()=>{const {decodeJwt}=await import('jose');console.log(JSON.stringify(decodeJwt(process.argv[1]),null,2))})()" -- "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig"

Paste your JWT token into the input field. The tool immediately decodes the Base64URL-encoded header and payload — no secret required.

Review the decoded JSON for algorithm (alg), expiration (exp), subject (sub), and other claims.

Optionally enter your HS256 secret to verify the signature. For full validation workflows, use the JWT Validator. CLI decode snippets (without verify) are available below the widget.

Never paste production tokens on shared machines. All decoding happens in your browser.

const jwt = require('jsonwebtoken');
// Decode without verifying (insecure alone)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header, decoded.payload);
// Always verify in production:
const verified = jwt.verify(token, secret, { algorithms: ['HS256'] });

const jwt = require('jsonwebtoken');
// Decode without verifying (insecure alone)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header, decoded.payload);
// Always verify in production:
const verified = jwt.verify(token, secret, { algorithms: ['HS256'] });

import jwt
# Decode without verifying
decoded = jwt.decode(token, options={'verify_signature': False})
print(decoded)
# Verify in production:
payload = jwt.decode(token, secret, algorithms=['HS256'])

import "github.com/golang-jwt/jwt/v4"
// Parse without validation (check err only)
token, _, _ := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{})
claims := token.Claims.(jwt.MapClaims)

Continue learning

ToolsJWT ValidatorJWT EncoderJWKS Viewer

GuidesDecode a JWT Safely (Without Trusting It)Node.jsPythonGoJavaRuby

ArticlesDebug JWT Invalid SignatureHow to Decode a JWT Without the SecretHow to Validate a JWT TokenWhat Is JWT?

GlossaryJSON Web Token (JWT)JWT HeaderJWT PayloadBase64URL EncodingJWT Secret KeyJWT typ Headeralg:none (Unsecured JWT)Opaque Access Token

CompareHS256 vs RS256JWT vs Session CookiesJWS (JWT) vs Opaque Token

AlgorithmsHS256 (HMAC-SHA256)

ResourcesProduction JWT path

How to Use This Tool

Continue learning