JWT Decoder
Decode a JSON Web Token to inspect its header and payload without verifying the signature.
Hashing & encryption Client-side Base64URL decoding
Tool preview
How to use it
- 01
Paste the token.
- 02
Read the header and payload.
- 03
Check the expiry claim.
Limitations
- ! The signature is not verified, so a decoded token proves nothing about authenticity.
- ! Encrypted tokens (JWE) are not supported.
FAQ
Can I trust the payload after decoding?
No, anyone can craft a token with any payload; only a verified signature makes it trustworthy.
Why is the token three parts?
Header, payload and signature, each Base64URL encoded and dot-separated.
Is my token sent anywhere?
No, decoding happens in the page.
Files never leave your device
Processing happens in your browser using the File API, WebAssembly and Web Workers. There is no upload endpoint.
Technical details
- Processing
- Client-side
- Implementation
- Base64URL decoding
- Category
- Hashing & encryption
- Network requests
- None while processing