Does this tool verify the JWT's signature?

No, it only Base64URL-decodes the header and payload and parses them as JSON; validating a signature requires the issuer's secret or public key, which this tool never asks for or has access to.

Is a token I paste here sent to a server?

No, decoding happens with the browser's built-in atob and JSON.parse acting on the token you typed, so the raw JWT and its claims never leave the page, which matters since payloads often carry user identifiers.

Why does the exp claim show a status like expired?

The tool converts the exp claim, a Unix timestamp in seconds, into a date and compares it against the current time in your browser, flagging tokens whose expiry has already passed.

Why did decoding fail on my token?

A JWT needs exactly two or three dot-separated segments where the header and payload are valid Base64URL-encoded JSON; a copy-paste that drops characters or wraps the token across lines breaks that structure.

JWT Decoder

Decode a JSON Web Token's header and payload and inspect its claims, locally.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Decode a JWT and inspect its claims

This tool splits a JSON Web Token into its header and payload, Base64URL-decodes each segment, and parses them as JSON so you can read the algorithm, type and claims at a glance. Time-based claims, exp, iat and nbf, are rendered as readable dates with an expired or not-yet-valid status. It only decodes, it never checks the signature, and the token you paste in is parsed entirely in the browser.

How to use the JWT Decoder

Paste a JWT, the three dot-separated Base64URL segments, into the input.
Read the decoded header, which typically shows the algorithm and token type.
Read the decoded payload, with each claim listed as a row.
Check the highlighted exp/iat/nbf rows for expired or not-yet-valid status.

This is a decoder, not a verifier. It never checks the signature against a secret or public key, so a token shown here as parsed successfully has not been proven authentic, only readable.

A JWT can have two or three segments; a token with no signature segment (alg: none, or truncated) still decodes here as long as the header and payload are valid Base64URL JSON.

Frequently asked questions

Does this tool verify the JWT's signature?: No, it only Base64URL-decodes the header and payload and parses them as JSON; validating a signature requires the issuer's secret or public key, which this tool never asks for or has access to.
Is a token I paste here sent to a server?: No, decoding happens with the browser's built-in atob and JSON.parse acting on the token you typed, so the raw JWT and its claims never leave the page, which matters since payloads often carry user identifiers.
Why does the exp claim show a status like expired?: The tool converts the exp claim, a Unix timestamp in seconds, into a date and compares it against the current time in your browser, flagging tokens whose expiry has already passed.
Why did decoding fail on my token?: A JWT needs exactly two or three dot-separated segments where the header and payload are valid Base64URL-encoded JSON; a copy-paste that drops characters or wraps the token across lines breaks that structure.