Does the JWT Decoder verify the signature?

It decodes and displays the token contents and flags insecure algorithms. Verifying the signature requires the secret or public key; decoding shows the claims without validating the signature.

Is my token sent anywhere?

No. Decoding happens entirely in your browser. Because tokens are sensitive credentials, this matters — your token never leaves your device.

Can I see when the token expires?

Yes. The exp and nbf claims are decoded and validated, with badges for expired or not-yet-valid tokens.

What token format is supported?

Standard JWTs using Base64URL-encoded header and payload (JWS), the format used by most authentication systems.

Is it safe to decode production tokens?

Decoding is local-only, but treat any real token as a secret. Prefer test tokens and never share a valid production token.

JWT Decoder

Decode, inspect, and validate JSON Web Tokens

Help

Paste a JWT token to decode it

Auto-decodes on paste — supports all standard claims

About this tool

The JWT Decoder parses JSON Web Tokens and shows the decoded header, payload, and signature in a readable format. Paste a token to inspect its claims — issuer, expiry, subject, and scopes — entirely in your browser. It auto-detects tokens on paste, flags expired or not-yet-valid tokens, and warns about insecure algorithms like 'none'.

How to use it

Paste your JWT. Paste the full token (header.payload.signature) into the input.
Read the decoded claims. The header and payload are Base64URL-decoded and displayed as formatted JSON.
Check expiry and claims. Inspect standard claims such as exp, nbf, iat, iss, and sub to debug your token.
Copy what you need. Copy the decoded payload or any individual claim for use in your tests.

Frequently asked questions

Does the JWT Decoder verify the signature?: It decodes and displays the token contents and flags insecure algorithms. Verifying the signature requires the secret or public key; decoding shows the claims without validating the signature.
Is my token sent anywhere?: No. Decoding happens entirely in your browser. Because tokens are sensitive credentials, this matters — your token never leaves your device.
Can I see when the token expires?: Yes. The exp and nbf claims are decoded and validated, with badges for expired or not-yet-valid tokens.
What token format is supported?: Standard JWTs using Base64URL-encoded header and payload (JWS), the format used by most authentication systems.
Is it safe to decode production tokens?: Decoding is local-only, but treat any real token as a secret. Prefer test tokens and never share a valid production token.