Decoding is not verification
Anyone can Base64URL-decode a JWT payload. A decoded token must not be trusted until its signature, algorithm, issuer, audience, and relevant claims are verified by a trusted authentication library.
JWT Decoder
Decode the Base64URL header and payload of a JSON Web Token. Inspect standard claims, timestamps, expiration status, and the encoded signature segment, with no token verification or server request.
Features
Decode JWT structureView header and payloadValidate token formatClaims inspectionExpiration checkingCopy decoded parts
How to use the JWT Decoder
- 1Paste the complete JWT into the input.
- 2Review the decoded header and payload JSON.
- 3Inspect standard claims such as issuer, subject, audience, issued-at, and expiration.
- 4Use a trusted server-side library and secret or public key when signature verification is required.
Common uses
- Debug token claims during authentication development.
- Check whether a token appears expired.
- Inspect the declared signing algorithm and token type.
Frequently asked questions
Does this tool verify the JWT signature?
No. It decodes the token only and does not prove that the contents are authentic.
Is the token sent to a server?
No. Decoding happens locally in your browser.
Can I use the expiration display as an authorization check?
No. Applications must verify the signed token and all required claims on a trusted server.