Does this verify the signature?

No. Verification needs the secret or public key, so it must happen on your server. This tool only decodes.

Is my token sent anywhere?

No. Decoding happens in your browser and the token is not stored or logged. Even so, avoid pasting live production tokens.

What do exp, iat and nbf mean?

They are Unix timestamps for expiry, issued-at and not-before. The decoder shows them as readable dates.

Is decoding a JWT the same as verifying it?

No. Decoding reads what's inside the token. Verification confirms the token hasn't been modified and was signed by a trusted authority. Verification requires the signing key.

Can anyone decode my JWT?

Yes, anyone with the token can decode it. That's why JWTs should never contain passwords or sensitive data. The signature proves the token is authentic, but the contents are visible.

JWT Decoder

Decode JWT header and payload claims locally in your browser.

JWT

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoded locally in your browser. Do not paste sensitive production tokens.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Signature

SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

This is the raw signature segment. It is not verified — no signing key was provided, and this tool never claims to validate a signature it can't check.

About JWT Decoder

A JWT is three Base64URL segments separated by dots: header, payload and signature. The first two are only encoded, not encrypted, so anyone holding the token can read the claims.

This decoder never verifies the signature — doing so requires the signing key, which should never leave your server. Treat the decoded output as informational and never paste production tokens into any online tool, including this one.

How to use JWT Decoder

1Paste your JWT token into the input field
2The decoder automatically extracts the three parts: header, payload, and signature
3View the decoded header (algorithm, token type)
4View the payload claims (user ID, roles, expiry time, custom data)
5Check the signature hash to inspect token integrity
6Note: decoding does not verify the signature (server-side only)

Example

Example JWT

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiaWF0IjoxNjA0MDI3MDAwLCJleHAiOjE2MDQxMTM0MDB9.5mJRyKbhWlE9X1iC3d

Output

Header:
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "1234567890",
  "name": "Alice",
  "iat": 1604027000 (Jan 1, 2021),
  "exp": 1604113400 (Jan 2, 2021)
}

When to use JWT Decoder

Inspecting JWT claims during development and debugging
Checking token expiry times to diagnose authentication issues
Verifying that custom claims are included in a token
Examining token structure in CI/CD logs
Understanding what data is embedded in a JWT

Common errors & troubleshooting

Invalid JWT format

A JWT must have exactly 3 parts separated by dots. Check that you pasted the complete token including all parts.

Token claims don't match expectations

The server that issued the token decided what claims to include. If claims are missing, contact the server admin or check the token issuance code.

Expiry time already passed (exp claim shows past date)

The token has expired. Request a fresh token from the authentication server. The client should have automatically refreshed it.

Limitations & details

Only decodes and displays the token structure; does not verify signatures
Cannot verify the token is legitimate without the secret key
Shows the algorithm used but cannot detect if it's a weak choice
Treats all tokens as if they're correctly formatted; malformed tokens may decode incorrectly