Does this verify the token signature?

No. The tool only decodes the token. Verify signatures on your server with the correct secret or public key.

Is it safe to paste a live token?

Decoding runs in your browser and nothing is sent anywhere, but a token can grant access. Never paste a signing secret, and avoid live tokens on shared computers.

Developer utilities

JWT Decoder

Decode and inspect a JWT header and payload. This is not a signature check.

Warning: inspection only.

Decoding does not verify the signature, issuer, audience or expiry. Do not trust any decoded content. Never paste a signing secret here.

Paste a JWT to read its header and payload. Decoding happens in your browser, and the token is not sent anywhere.

JWT

Paste a JWT to decode it.

Header

Nothing to show yet.

Payload

Nothing to show yet.

Privacy: this tool runs in your browser. The data you enter is not sent to a server.

How to use JWT Decoder

Paste a JWT into the box.
Read the header and payload, which are decoded from Base64URL.
Check the time claims. Expired and not-yet-valid tokens are marked.

What is a JWT and what does decoding show?

Frequently asked questions

Does this verify the token signature?: No. The tool only decodes the token. Verify signatures on your server with the correct secret or public key.
Is it safe to paste a live token?: Decoding runs in your browser and nothing is sent anywhere, but a token can grant access. Never paste a signing secret, and avoid live tokens on shared computers.

JSON & data