Every JWT decoder can show you what’s inside a token. Ours also draws a hard line around what it can’t honestly do. Our new JWT Decoder decodes the header and payload — and says plainly that it never verifies the signature.
- Instant decode — paste a token and see the header, payload, and raw signature update as you type, no page reload.
- Expiry at a glance — if the payload has an
expclaim, a badge tells you immediately whether the token is still valid or already expired, with the exact date and time. - No fake verification — checking a signature needs the issuer’s secret or public key, and that key has no business inside a browser tool. This one only decodes, and it says so up front, so a decoded token never gets mistaken for a verified one.
- Correct base64url handling — JWTs use base64url, not standard
base64 (
-/_instead of+//, no padding); this tool converts that correctly before decoding, so tokens with those characters don’t produce garbled output. - Private by default — splitting and decoding happens entirely in your browser; nothing you paste is ever sent to a server. Still, a live JWT often carries real session data, so treat it with the same care you’d give a password.
Paste in one of your own tokens, or click “Try an example” to see it work immediately. Need it inside your own admin tool or docs site? It’s embeddable with one iframe.