JWT Decoder
Decode header and payload locally. The signature is not verified.
Important
Decoding a JWT does not prove authenticity. Verify signature, issuer, audience, and time claims before trusting the claims.
Questions about this tool
Does decoding a JWT verify its signature?
No. Base64URL decoding only reveals header and payload. Signature verification requires the correct key, algorithm and validation rules.
Which JWT claims should I inspect first?
Review exp, nbf, iat, iss, aud and subject/role claims according to the application trust model.
Is it safe to paste a production JWT into a tool?
Prefer a redacted or test token. A JWT can contain personal data and bearer tokens may grant access while valid.