Private Everything runs in your browser. No uploads, no tracking, no signup./ zero data collected
Tools / 02 · JWT Debugger
JWT Debugger
Decode the header and payload of a JWT. Unlike most online decoders, your token is never sent to a server.
—
Signature verification is not performed — only header and payload are decoded (they are plain base64url).
Frequently asked questions
- Does this send my token anywhere?
- No. The header and payload are base64-decoded locally in your browser. The token is never transmitted, logged, or stored, which matters because JWTs often contain email addresses and authorization claims.
- Can it verify the signature?
- It displays the signature and tells you the algorithm, but verifying it requires the secret or public key. We intentionally do not ask for that secret, so verification stays a server-side responsibility.
- What are the three parts of a JWT?
- A JWT is
header.payload.signature, each segment base64url-encoded. The header describes the algorithm; the payload carries the claims; the signature proves the token was not tampered with. - Why decode client-side instead of on a website that uploads?
- Uploading a live token to someone else's server is a leak risk. Local decoding gives you the same readability with zero exposure.