Encoding Utility
JWT Decoder
Decode a JSON Web Token header and payload locally in your browser. Inspect claims, expiration timestamps, and Base64URL segments without sending the token to a server.
Decoding a JWT is not authentication. A decoded token can be expired, forged, or unsigned unless your application verifies the signature with the correct key.
Detailed guide
Need the assumptions, examples, and troubleshooting?
The calculator stays focused here. The supporting reference has moved to its own page.
Read the JWT Decoder guideFrequently asked questions
Does this JWT decoder upload my token?
No. The JWT is decoded locally in your browser and WebUtilsLab does not save or upload the token you paste.
Does decoding a JWT verify its signature?
No. Decoding only reads the header and payload. Signature verification requires the correct key and must be done in your trusted application environment.
Can this tool decode Base64URL JWT segments?
Yes. JWT header and payload segments use Base64URL encoding, which this tool decodes before parsing JSON.