How to decode JWTs safely

Decode JWT header and payload locally, and avoid sharing sensitive tokens with unknown services.

A JWT contains a header, payload, and signature. The header and payload are Base64URL-encoded, not encrypted.

Never paste production access tokens into tools you do not trust. Prefer local decoding when inspecting claims, expiry, subject IDs, or scopes.

WiseTool’s JWT Decoder runs in your browser and does not upload the token.

Decode JWT header and payload locally so you can inspect claims without uploading tokens. Runs in your browser with no account required.

Encode or decode Base64 text for tokens, configs, and quick debugging. Runs in your browser with no account required.

Format and pretty-print JSON so it is easier to read, debug, copy, and share. Runs in your browser with no account required.