Need help implementing this in a real project?
We help businesses with:
- Web Development
- Ecommerce Integrations
- Automation
- Technical SEO
A JWT is three Base64URL-encoded segments joined with dots - header, payload, and a signature that a server computes to prove the first two haven't been tampered with. This decodes and displays the header and payload as readable JSON, lets you edit either and re-encode the token, all client-side.
When you'd use this
Inspecting what claims a token actually carries during API debugging - expiry, issuer, custom claims - without writing a script just to base64-decode two segments by hand.
Testing how your own backend handles a modified token during development: change a claim, re-encode, and see what your server does with it.
Common errors
"Failed to parse JSON" on the payload or header usually means the pasted token is truncated, has extra whitespace, or isn't actually a JWT (a JWE, or an opaque access token from an OAuth provider, use a different - often non-decodable - format).
Frequently asked questions
Does this verify the token's signature?
No - this decodes and re-encodes the header and payload only. It doesn't check the signature against a secret or public key, so it can't tell you whether a token is cryptographically valid, only what claims it contains. Treat any "editing" here as a way to inspect and experiment with token contents, not as proof a token would pass real verification.
Is it safe to paste a production token in here?
Nothing you paste is transmitted anywhere - decoding and editing happens entirely in your browser. That said, treat access tokens like credentials generally: avoid pasting a live production token anywhere unnecessarily, this tool included, since anyone who can read a valid JWT can typically use it until it expires.
Why does the token look different after I edit a payload value?
Editing the payload and re-encoding produces a new second segment, but the signature (the third segment) isn't recalculated to match - since that requires the signing secret or private key, which this tool never has. The re-encoded token will decode fine but won't pass real signature verification unless you separately re-sign it with the correct key.
API & Debugging Cluster
Often used together when debugging APIs.
JSON Formatter
Clean, format, parse, and validate JSON inputs with instant syntax lint warnings and code export.
Encoder / Decoder
Encode and decode standard Base64 translations, HTML escape entities, or URL navigation parameters.
Hash Generator
Generate SHA-1, SHA-256, SHA-512, and MD5 cryptographic hash values for strings in real time.
Timestamp Converter
Convert Unix epoch timestamps to readable dates and back, in local time or UTC.
Related Utilities You Might Need
JSON Formatter
Clean, format, parse, and validate JSON inputs with instant syntax lint warnings and code export.
IP Address & Location Lookup
Find your public IP address, approximate location, ISP and timezone instantly.
Code to Image
Convert your raw code snippets into visually appealing, shareable screenshots with custom gradient frames.