Decode JWT header and payload locally without verification.
No. Decoding is Base64URL parsing in your browser only.
No. Treat results as untrusted claims unless you verify the signature in your own backend.
The token may be truncated, not Base64URL, or not valid JSON in the header/payload parts.
Prefer redacted or expired tokens. Anyone with your screen or clipboard could see sensitive claims.
Paste a JWT to decode header and payload. Signature is not verified.