Decode and inspect JWT header & payload — decoding only, no signature verification | 100% Private
Instantly view the decoded, pretty-printed JSON of both JWT segments.
See at a glance whether the token's "exp" claim indicates it's expired or valid.
Clearly does not claim to validate signatures, avoiding a false sense of security.
All decoding happens locally in your browser. Nothing is ever uploaded.
A JWT (JSON Web Token) consists of three Base64url-encoded segments separated by dots: a header, a payload, and a signature. Decoding simply reverses the Base64url encoding to reveal the JSON contents of the header and payload — this requires no secret key and can be done by anyone.
Verifying a JWT's signature proves the token was issued by a trusted party and hasn't been tampered with — but that check requires the secret (HMAC) or public key (RSA/ECDSA) used to sign it. Since that key belongs to the issuing server and is never exposed to clients, no purely client-side tool — including this one — can legitimately verify a JWT's signature. Use this decoder only for inspecting and debugging token contents, never as proof that a token is authentic or untampered.
No. Decoding happens entirely in your browser using JavaScript. Your token never leaves your device.
No. This tool only decodes and displays the header and payload — it does NOT verify the signature. Verifying a signature requires the secret key or public key that signed the token, which this client-side tool never has access to. A decoded token should never be trusted as authentic without server-side signature verification.
A JSON Web Token (JWT) is a compact, URL-safe token format made of three Base64url-encoded parts — header, payload, and signature — separated by dots, commonly used for authentication and authorization.
If the payload contains an "exp" claim, the tool compares it to the current time and shows whether the token is expired, valid, or has no expiry claim at all.
A JWT must have exactly three dot-separated Base64url segments. If your input is malformed, missing a segment, or not valid Base64url/JSON, decoding will fail and an error will be shown.