JWT Decoder
Paste any JSON Web Token and instantly see its decoded header and payload in formatted JSON. The signature is displayed separately. No signature verification is performed — all decoding happens in your browser, and your token is never sent anywhere.
Decode the three-part structure of a JSON Web Token to inspect its header and payload in readable form. The tool also shows the signature segment, but it does not verify that signature or prove that the token is authentic or trustworthy.
How to decode a JWT
- Paste a JWT containing three dot-separated segments.
- Select Decode to process the header and payload.
- Review the formatted JSON when the decoded content is valid JSON, or the raw decoded text otherwise.
- Copy the header or payload if you need to inspect it elsewhere.
What the JWT decoder does
The decoder expects exactly three dot-separated parts. It converts Base64URL characters back to standard Base64, restores required padding, and decodes the first two parts with the browser atob function.
If the decoded header or payload is valid JSON, the tool pretty-prints it. The third segment is displayed as the signature text only. No cryptographic key, issuer metadata, audience rule, expiration policy, or signature algorithm verification is performed.
Privacy and security limitations
The token is processed locally in your browser and is not intentionally uploaded to Votilo for decoding. Treat JWTs as potentially sensitive credentials: decoding a token is not the same as verifying it, and you should avoid pasting production secrets into tools you do not trust.
Frequently asked questions
Does this tool verify a JWT signature?
No. It only decodes and displays the token parts.
Can a decoded JWT still be fake or modified?
Yes. Readable header and payload data do not prove authenticity.
Why does my token need three parts?
This decoder expects the common header.payload.signature JWT structure and rejects other part counts.
What happens if the payload is not JSON?
The decoded raw text is displayed instead of formatted JSON.
Is the token sent to a server?
The decoding logic runs locally in the browser.