PRIVATE ENCODING TOOLBOX
JWT Decoder
Inspect JWT headers and payloads without verification.
Encoding changes representation, not meaning or security. Results are generated locally and are not encryption.
•
JWT Decode
Inspect JWT headers and payloads without verification.
Enable JavaScript to use this interactive local tool. The guide below remains available without JavaScript.
Customize
QUICK GUIDE
How to inspect a JWT safely
A JSON Web Token normally contains a Base64URL header, payload, and signature. QRFoundry decodes the first two parts for inspection only. It does not verify the signature, issuer, audience, expiry policy, or authenticity.
Local processing
Nothing you enter or upload is sent to a server, saved, or shared.
Nothing you enter or upload is sent to a server, saved, or shared.
Use it in three steps
- Paste a three-part JWT.
- Review the decoded header, payload, and time claims.
- Treat the content as untrusted unless your application verifies the signature.
Practical example
ExampleeyJ...header.eyJ...payload.signature
Format limitsEncrypted JWE tokens and opaque session tokens cannot be decoded as standard three-part JWTs.
Common errorsA JWT needs exactly three dot-separated parts with valid Base64URL JSON in the first two.
Frequently asked questions
Does decoding verify a JWT?
No. Decoding proves nothing about authenticity.
Is the token sent anywhere?
No. It stays in the browser.
Should I paste production tokens?
Avoid sharing live credentials unnecessarily, even with local tools.