Is my token sent anywhere when I decode it?

No. The token is decoded entirely in your browser and is never transmitted. Because the work is local, it is safe to inspect tokens that may carry sensitive claims.

Does this verify the JWT signature?

No. The tool only decodes the header and payload. It does not verify the signature, so it cannot tell you whether a token is authentic or has been tampered with.

What does the output look like?

You get pretty-printed JSON shaped as { header, payload }, where both parts are decoded from their base64url segments for easy reading.

JWT to JSON Decoder — Free Online Tool

Decode a JWT header and payload to JSON instantly in your browser. Free and private: the token is never sent and stays on your device.

Instant Private Zero cookies

Indentation

JWT input

JSON output

Why decode a JWT to JSON?

A JSON Web Token packs its header and payload into compact base64url segments that you cannot read at a glance. Paste a token above and instantly see the decoded claims, which is perfect for debugging authentication flows and checking what a token actually contains.

How it works

The decoder splits the token, decodes the base64url header and payload, and prints them as formatted JSON in the shape { header, payload }. It does not verify the signature; it only decodes, so treat the result as informational rather than a proof of authenticity. All of this happens in your browser, which means even tokens with sensitive claims stay on your device.

Frequently asked questions

Is my token sent anywhere when I decode it?: No. The token is decoded entirely in your browser and is never transmitted. Because the work is local, it is safe to inspect tokens that may carry sensitive claims.
Does this verify the JWT signature?: No. The tool only decodes the header and payload. It does not verify the signature, so it cannot tell you whether a token is authentic or has been tampered with.
What does the output look like?: You get pretty-printed JSON shaped as { header, payload }, where both parts are decoded from their base64url segments for easy reading.