JWT decoder

Paste a token to see what’s inside. It’s decoded in your browser and never sent anywhere, but treat real tokens like passwords all the same.

This reads the token without checking its signature, so it can’t tell you whether the token is genuine. Your server checks that with its secret or public key.