JWT Decoder
The signature is shown, not verified.
This tool only base64url-decodes the three segments. Without the signing key it cannot tell a genuine token from one an attacker edited, so nothing here says a token is valid or trustworthy.
A JWT is a live credential: do not paste production or customer tokens into any web tool, including this one.
Signature (base64url, unverified)
Signature will appear here...
Checking this signature needs the issuer's secret or public key, which this tool never asks for and never has. Verify tokens in your own backend.
About the JWT Decoder
Inspect a JSON Web Token without writing code. The decoder splits the token into header, payload and signature, pretty-prints the JSON and turns the exp, nbf and iat timestamps into readable UTC dates. It does not verify signatures, so use it for debugging, not for trust decisions.
How to use it
- 1 Paste the token into the JWT token pane.
- 2 Read the decoded Header and Payload.
- 3 Check the Expiration, Not Before and Issued At dates under Time claims.
- 4 Copy the header or payload, and verify the signature in your own backend.
Frequently asked questions
No. Verifying needs the issuer's secret or public key, which this tool never asks for. It only base64url-decodes the segments, so it cannot tell a genuine token from an edited one.
Treat every JWT as a live credential. Decoding happens on our server, like every tool on this site, so do not paste production or customer tokens into this or any other web tool. Use test tokens instead.
A JWT is three base64url segments separated by dots: a header naming the algorithm and token type, a payload of claims, and a signature over the first two.
exp is the expiration time, nbf the time before which the token must not be accepted, and iat the time it was issued. All three are Unix timestamps, shown here as UTC dates.
No. An encrypted token has five parts and its payload cannot be read without the key, so the decoder reports that a JWT must contain header, payload and signature segments.