Martin von WysieckiJWT Decoder
Inspect the structure of sanitized, expired, or synthetic JWT test data. Decoding happens locally in your browser.
Security notice
Never enter an active production token, password, API key, or other login credential. Use only sanitized, expired, or synthetic test data. The value is processed locally and is never sent to this site or any third party.
Header
Payload
Signature
How to Use
Use only sanitized, expired, or synthetic test data in header.payload.signature format. Never enter an active credential.
Inspect the decoded header, payload, signature, registered claims, and timestamps.
Copy individual sections when needed. All processing stays in your browser.
This tool does not verify JWT signatures. It only decodes Base64url-encoded test data locally; input is not transmitted or stored.