Developer
JWT Decoder
Paste a JSON Web Token to decode its header, payload, and signature. This tool decodes locally in your browser — it does not verify signatures.
Sample Tokens
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the token to show you the header, payload, and signature — it does not verify that the signature is valid. Verifying a signature requires your secret or public key, which this tool never asks for.
Is it safe to paste a real token here?
Decoding happens entirely in your browser; the token is never uploaded or sent to any server. Still, treat live tokens as secrets — anyone who reads a JWT payload can see its claims, since the payload is only Base64-encoded, not encrypted.
What do the Issued and Expires fields mean?
They read the iat (issued-at) and exp (expiration) claims from the payload and show human-readable dates, plus a status badge telling you whether the token is currently active or expired.
Can a decoded token be expired but still decode fine?
Yes. Decoding works regardless of expiry — an expired token still shows its full contents and is simply flagged as expired in the status bar.