Does this verify the JWT's signature?
No. It only decodes the header and payload — verifying a signature requires the issuer's secret or public key, which this tool doesn't use.
Developer Tools
Decode a JWT's Header and Payload
Decode a JSON Web Token's header and payload into readable JSON, right in your browser.
What decoding does and doesn't prove
Paste a JWT (a string in header.payload.signature format) and this tool splits it on the periods, base64url-decodes the header and payload sections, and shows both as formatted JSON. That's the entire operation — decoding, not verifying.
This is an important distinction: anyone can decode a JWT's header and payload, since that part isn't encrypted, only encoded. Decoding here tells you what claims a token contains, but it does not confirm the token's signature is valid, that it hasn't expired, or that it was actually issued by the service it claims to be from. Verifying a JWT requires the issuer's secret or public key, which this tool doesn't have and isn't asking for.
Workflow at a glance
Use this quick flow to understand where the tool fits in your work and what to review before relying on the output.
Review checklist
Before
Know that this only decodes claims — it can't verify the token's signature or check whether it has expired.
After
Manually check the exp claim's timestamp and confirm the claims match what you expected before trusting the token elsewhere.
When decoding (not verifying) is what you need
Use it to quickly inspect what claims are inside a JWT you already have — during debugging, when reading a token from a log, or when checking what a token contains before deciding how to use it in code.
Who decodes JWTs
Backend developers
Inspect a JWT's claims while debugging an authentication or authorization issue.
Frontend developers
Check what a token actually contains before deciding how to read it in client code.
QA engineers
Verify a test JWT contains the expected claims before running a test case.
Support engineers
Decode a token from a bug report to understand what claims it carries.
What this decoder shows
Header and payload decoding
Both sections of the token are base64url-decoded and shown as formatted JSON.
No signature verification
This tool doesn't check whether the token's signature is valid — it only reads the encoded claims.
No expiry check
It doesn't evaluate the exp claim against the current time — you need to read that value yourself.
Clear error for malformed tokens
A string that doesn't have the expected header.payload.signature structure produces a clear message instead of a confusing failure.
Decoding a token step by step
- 1Paste the JWT you want to inspect.
- 2Read the decoded Header and Payload sections shown as JSON.
- 3Check the claims you need, such as exp, iat, or any custom fields.
- 4Remember this doesn't confirm the token is valid or unexpired — check those values yourself.
Where this fits into debugging
Inspecting a JWT's claims while debugging an authentication or authorization issue.
Checking what a token actually contains before deciding how to read it in client code.
Verifying a test JWT contains the expected claims before running a test case.
Decoding a token from a bug report to understand what claims it carries.
Where your token goes
Decoding happens entirely in your browser using base64url decoding — the token is never sent to a server or verified against any external service.
Reading a decoded token correctly
- Check the exp claim's timestamp yourself if you need to know whether a token has expired.
- Never treat a decoded JWT as proof of authenticity — decoding shows you the claims, not whether the signature is valid.
- Avoid pasting a real production token here if you're at all concerned about exposing it, even though nothing is transmitted.
- Use Timestamp Converter alongside this if you need to convert an exp or iat Unix timestamp into a readable date.
JWT mistakes to avoid
Treating a decoded token as verified
Decoding reads the claims; it does not confirm the signature is valid or that the token is genuine.
Not checking the expiry claim manually
This tool doesn't evaluate exp against the current time — you need to check that value yourself.
Pasting a live production token casually
Treat real tokens with the same care as any other credential, even in a decode-only tool.
Assuming JWT contents are encrypted
The header and payload are only encoded, not encrypted — anyone can decode them without a secret key.
Decoding versus verifying
JWT Decoder shows you exactly what claims a token contains, quickly and locally. It intentionally stops there — verifying a token's authenticity and expiry needs to happen in your actual authentication code, with the real secret or public key.
Need hands-on help?
Get help with documents, SEO, content, or website fixes
Use this tool for quick work. If you need a real file prepared, a page reviewed, or a website issue fixed, send the URL and describe the problem.
FAQ
JWT Decoder FAQ
Answers for using JWT Decoder on I Love Tool XYZ.
Does it check if the token is expired?
No, it doesn't evaluate the exp claim against the current time — check that value yourself in the decoded output.
Are JWT contents encrypted?
No, the header and payload are only encoded, not encrypted, so anyone can decode them.
Is my token sent to a server?
No. Decoding happens entirely in your browser.