JWT Decoder
Decode and inspect JWT tokens — header, payload, and signature — without verification.
Header
Payload
Signature
Token info
Frequently Asked Questions
Does this tool verify whether my JWT signature is valid?
No. The component only decodes the three JWT parts and explicitly warns that it does not verify the signature, so you still need server-side validation.
Why does it say my token is invalid even though it has dots in it?
A JWT must have exactly three parts, and the first two parts must decode into valid JSON. If the Base64URL data or JSON is malformed, the tool shows a decode error.
Why can I read the payload without the secret key?
Because JWT payloads are usually Base64URL-encoded, not encrypted. This decoder simply turns the header and payload back into readable JSON.
Can it tell me if the token is expired?
Yes. If the payload has an `exp` claim, the tool compares it with the current time and marks expired values in red in the claim summary.
Why aren't all my custom claims shown in the summary cards?
The summary grid only pulls out common fields like `iss`, `sub`, `aud`, `exp`, `iat`, `nbf`, and `alg`. Your full payload is still shown above as pretty-printed JSON.