Does decoding verify the token is authentic?

No. Decoding only reads the header and payload, which anyone can do without knowing the signing key. Verifying a signature requires the key or secret used to sign it, which this tool never asks for.

Is my token sent anywhere?

No — decoding happens entirely in your browser. The token is never uploaded, logged, or sent to analytics.

What if the token is malformed?

You'll get a specific error — missing segments, invalid Base64URL, or a payload that isn't valid JSON — rather than a silent failure.

Security & Cryptography Tools

JWT Decoder

Decode a JSON Web Token to inspect its header, payload, and claims, with human-readable timestamps for issued-at, expiration, and not-before. Decoding a JWT does not verify its signature — only knowing the signing key can do that.

Decoding a JWT does not verify its signature. Anyone can read or edit the header and payload of a JWT without knowing its secret — only verification against the original signing key confirms a token is authentic. Nothing shown below should be treated as proof the token is valid.

Paste a token to decode it — nothing leaves your browser

JWT

JWT Inspector

A deeper look at a JWT's structure, sizes, and expiration status.

JWT Generator

Encode and HMAC-sign a JWT for testing, entirely in your browser.

Base64 Decoder

Decode Base64 back to text, with invalid-input detection.

Features

Header and payload panels, plus the raw (unverified) signature
Human-readable issued-at, expiration, and not-before timestamps
Clear expiration status when an exp claim is present
Copy the header, payload, or the full decoded result as JSON

How to use

Paste a JWT (three dot-separated segments) into the input.
The header, payload, and claims are decoded automatically.
Copy any section you need.

FAQ

Does decoding verify the token is authentic?: No. Decoding only reads the header and payload, which anyone can do without knowing the signing key. Verifying a signature requires the key or secret used to sign it, which this tool never asks for.
Is my token sent anywhere?: No — decoding happens entirely in your browser. The token is never uploaded, logged, or sent to analytics.
What if the token is malformed?: You'll get a specific error — missing segments, invalid Base64URL, or a payload that isn't valid JSON — rather than a silent failure.