Does this tool verify the JWT signature?
No. Decoding and verification are different operations. This tool decodes the token to show its contents. Signature verification requires the secret key or public key and should be done server-side.
JWT Decoder decodes JSON Web Tokens instantly, revealing the header algorithm, all payload claims (sub, iat, exp, aud, iss, and custom claims), expiry status, and security warnings — all without verifying the signature. Developers use this tool to debug authentication flows, inspect OAuth2 access tokens, diagnose expired session tokens, and verify that identity providers are returning the correct claims in their JWTs. Your token is never uploaded — decoding runs entirely in your browser.
A JWT consists of three Base64URL-encoded segments separated by dots: header.payload.signature. Decoding the header and payload requires only Base64URL decoding — no secret key is needed. The signature, however, can only be VERIFIED using the original signing key. This tool decodes and displays the payload without performing signature verification.
No. Decoding and verification are different operations. This tool decodes the token to show its contents. Signature verification requires the secret key or public key and should be done server-side.
Yes. The tool runs entirely in your browser. Your token is never sent to any server. However, avoid sharing JWT tokens in screenshots or public pages, as they grant access until expiry.
Standard claims include: sub (subject), iat (issued at), exp (expiry), iss (issuer), aud (audience), and jti (JWT ID). Custom claims add application-specific data like user roles, emails, and permissions.
The decoder shows the exp claim as a human-readable date and tells you if the token is expired, active, or has no expiry set.
Yes. The payload and header are only Base64URL-encoded (not encrypted). Anyone can decode them without knowing the signing secret. This is by design in the JWT specification.
Yes, completely free. No account or sign-up required.
Tool workspace
Free JWT decoder online — instantly decode and inspect JWT token payload, header, and claims. Debug authentication tokens securely in your browser. No login required.
Output
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
Header: {"alg":"HS256","typ":"JWT"} | Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}