JWT Decoder
The signature is shown, not verified.
This tool only base64url-decodes the three segments. Without the signing key it cannot tell a genuine token from one an attacker edited, so nothing here says a token is valid or trustworthy.
A JWT is a live credential: do not paste production or customer tokens into any web tool, including this one.
Up to 8,192 characters.
Header
Payload
Signature (base64url, unverified)
Signature will appear here...
Checking this signature needs the issuer's secret or public key, which this tool never asks for and never has. Verify tokens in your own backend.