A JWT (JSON Web Token) is a compact, three-part token used for authentication and authorization. This tool decodes the header and payload of any JWT so you can inspect its claims and expiration — entirely in your browser.
A JWT has three Base64URL-encoded parts separated by dots: a header (algorithm/type), a payload (claims — the actual data), and a signature (verifies the token wasn't tampered with, using a secret only the issuing server knows). Decoding the header and payload requires no secret; verifying the signature does.
No — it only decodes and displays the header and payload, which requires no secret. Verifying a signature requires the issuer's secret key or public key, which this tool intentionally doesn't ask for.
Yes — the payload is plain, readable data (not encrypted), so anyone with the token can see its claims. Never paste a production JWT from a system you don't control into a third-party tool.