JWT decoder
Inspect JWT headers and payloads locally.
How it works & limits
How to use this tool
Inspect JWT headers and payloads locally.
Paste or enter your content. The result updates as you type. Choose an option only when you need to change the default.
JWT payloads are merely decoded. No signature, expiry, issuer or audience verification is performed. A decoded token is not proof of authenticity.
Example input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwibmFtZSI6IkFsZXgiLCJpYXQiOjE3OTM1Nzc2MDB9.ZGVtby1zaWduYXR1cmU
Local processing
Your input stays in this browser. Drafts are kept in page memory while switching tools, and disappear on reload.
Text is limited to 1 million characters. Regex runs in a worker, capped at 200,000 characters, 1,000 matches and 1.5 seconds. Inputs above 100,000 characters use manual refresh.
The first page load and on-demand modules require network access. A complete offline cache is not included.