Toolgeist › Developer
JWT Decoder — Inspect Header & Payload Without Verifying
Paste a JWT to instantly decode and inspect its header and payload claims — useful for debugging what a token actually contains. Decoding requires no secret key because the payload is only base64-encoded, not encrypted; this shows you the contents, but does not confirm the signature is valid. For that, use JWT Inspector.
How to use JWT Decoder
- Paste the JWT.
- Read the decoded header and payload as JSON.
- Check claims like exp, iat and custom fields.
Frequently asked questions
- Does decoding prove the token is valid?
- No. Anyone can decode a JWT's payload without the secret, because it is only base64-encoded — decoding shows you the claims, but verifying the signature (which requires the secret or public key) is what actually confirms authenticity.
- Why can I read a JWT's contents without the secret?
- JWT payloads are base64url-encoded JSON, not encrypted — the signature (the third part) is what requires a secret, and it protects against tampering, not against reading.
- What is the difference between this and JWT Inspector?
- This tool decodes and displays claims. JWT Inspector additionally checks structural validity and common misconfiguration issues like alg:none.
Related Developer tools
Also searched for: decode jwt online · jwt payload viewer · inspect jwt claims
Browse all 738 free tools on Toolgeist →