JWT Decoder
Decode JWT header and payload locally, and quickly inspect expiration state without server upload.
How to use JWT Decoder
- 1
Paste a three-segment JWT; the sample button can load a non-secret token for testing.
- 2
Review the decoded header and payload plus exp, nbf, and iat timestamps when present.
- 3
Treat every result as unverified until the signature, issuer, audience, and algorithm are checked by the application that trusts the token.
What You Can Do
- ✓JWT header/payload JSON view
- ✓Expiration status preview
- ✓Malformed token detection
- ✓Clear warning that decoding does not verify the signature
FAQ
Q. Does this verify signatures?
A. No. This tool is decode-only and does not verify signatures.
Q. Can I inspect exp claims quickly?
A. Yes. Expiry status is derived from payload exp when present.
Q. Is token data uploaded?
A. No. All decoding is done in-browser.
Technical Notes
The first two Base64URL segments are decoded and parsed as JSON for inspection; the signature segment is only detected, not validated.
The status indicator compares numeric exp and nbf claims with the current client clock. Clock error, issuer policy, audience, revocation, and server-side authorization are outside this decoder.
Security Limitations and Data Handling
Decoding runs in the browser and the tool action does not upload the token. JWT payloads are encoded, not encrypted, and may contain identifiers or permissions, so use a redacted sample when possible.
A readable payload is not proof of authenticity. Never grant access from this output; verify the signature and all required claims in the receiving application.