Text Tools: Word Counter Case Converter UUID Generator Timestamp Converter Lorem Ipsum JWT Decoder JSON Formatter Base64 URL Encoder JSON to CSV CSV to JSON Markdown to HTML

Free JWT Decoder

Decode and inspect JWT header & payload — decoding only, no signature verification | 100% Private

JWT Decoder

Decode only, not verify: This tool decodes and displays the JWT's header and payload for inspection. It does not verify the token's signature — doing so requires the secret or public key that signed it, which never leaves the issuing server. Never treat a decoded token as proof of authenticity.
Encoded JWT

Header & Payload

Instantly view the decoded, pretty-printed JSON of both JWT segments.

Expiry Status

See at a glance whether the token's "exp" claim indicates it's expired or valid.

Decode Only — No Verification

Clearly does not claim to validate signatures, avoiding a false sense of security.

100% Private

All decoding happens locally in your browser. Nothing is ever uploaded.

Decoding vs. Verifying a JWT

A JWT (JSON Web Token) consists of three Base64url-encoded segments separated by dots: a header, a payload, and a signature. Decoding simply reverses the Base64url encoding to reveal the JSON contents of the header and payload — this requires no secret key and can be done by anyone.

Important: This Tool Does Not Verify Signatures

Verifying a JWT's signature proves the token was issued by a trusted party and hasn't been tampered with — but that check requires the secret (HMAC) or public key (RSA/ECDSA) used to sign it. Since that key belongs to the issuing server and is never exposed to clients, no purely client-side tool — including this one — can legitimately verify a JWT's signature. Use this decoder only for inspecting and debugging token contents, never as proof that a token is authentic or untampered.

Frequently Asked Questions

Is my JWT sent to a server?

No. Decoding happens entirely in your browser using JavaScript. Your token never leaves your device.

Does this tool verify the JWT signature?

No. This tool only decodes and displays the header and payload — it does NOT verify the signature. Verifying a signature requires the secret key or public key that signed the token, which this client-side tool never has access to. A decoded token should never be trusted as authentic without server-side signature verification.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format made of three Base64url-encoded parts — header, payload, and signature — separated by dots, commonly used for authentication and authorization.

How do I know if my token has expired?

If the payload contains an "exp" claim, the tool compares it to the current time and shows whether the token is expired, valid, or has no expiry claim at all.

Why does the tool show an error for my token?

A JWT must have exactly three dot-separated Base64url segments. If your input is malformed, missing a segment, or not valid Base64url/JSON, decoding will fail and an error will be shown.