Decode a JSON Web Token (JWT) and inspect its header, payload and signature. This tool only decodes — it does NOT verify signatures.
Paste a JWT (three base64url-encoded parts separated by dots).
Security note
Anyone can decode a JWT — the payload is just base64-encoded JSON, not encrypted. Never put secrets in a JWT payload. Trust a token only after verifying its signature server-side with the signing key.