JWT Decoder
About this tool
Inspect JSON Web Tokens without sending them to a server. Split header and payload, pretty-print claims like exp, iat, iss, aud, and scopes, and see decoding errors for malformed Base64URL segments. Signature verification is intentionally not performed—treat payload as untrusted.
How to use
- Decode header and payload JSON
- Pretty-printed claim blocks
- exp/iat human-readable time hints when present
- Clear warnings that signature is unverified
- Copy header or payload JSON
- Paste JWT: Paste the full JWT.
- Decode: View the formatted header and payload.
- Inspect claims: Check expiry, issuer, and other claims. Note that signatures are not verified.
Examples
- View claims in an OAuth access token
- Check the expiry time represented by exp
- Understand the header, payload, and signature structure of a JWT
- Compare token contents from different environments
Limitations
- Does not validate signatures or trustworthiness
- Encrypted JWE tokens are not supported
- The JWT is decoded directly in your browser and is not sent to a server. Decoding does not verify its signature.
FAQ
- Is it safe to paste my JWT here?
- Decoding is local, but anyone with the token can often use it until expiry. Avoid pasting sensitive production tokens on shared computers.
- Why does it say signature not verified?
- Verification needs the issuer public key or secret. This tool only Base64URL-decodes JSON parts.
- Can I see if a token expired?
- If exp is present, the decoder shows a readable expiry time next to the Unix timestamp.