Paste a JWT string. Header and payload are Base64URL-decoded and shown as JSON. The signature is not decoded and is never verified here.
Security: Decoding is not verification. Anyone can craft a JWT with arbitrary claims; only checking the signature with the issuer’s keys (usually on a server) proves authenticity. Watch for alg: none and other tricks. Never trust a JWT from the client alone. Do not paste production tokens or secrets on shared machines. This page does not send your token anywhere.