Does decoding prove a JWT is valid?
No. A readable header and payload do not prove its signature, expiry or claims are valid.
Tools
JWT Decoder
Decode JWT header and payload locally. Signatures are not verified.
Decode the header and payload of a JSON Web Token locally to inspect their JSON fields. This page does not verify the token.
How to use this tool
- Paste a JWT with its dot-separated sections.
- Select Decode.
- Review the decoded header and payload JSON.
- Use a trusted authentication system to validate any token before relying on it.
Ways to use it
- Inspect token fields
- Read visible header or payload fields while troubleshooting an integration.
- Check an example token
- Review the JSON structure of a non-sensitive development token.
JWT decoder limits
- The tool decodes the header and payload only. It does not verify the signature.
- It does not validate expiry, issuer, audience, permissions or whether a token should be trusted.
- Decoding happens locally and the page does not save the token, but avoid pasting credentials into a shared device or screen.
Common questions
Does the tool verify the signature?
No. It is for inspection only and does not perform signature verification.
Can I trust the expiry shown in the payload?
No. Validate expiry and all claims through the system that issued or accepts the token.
Is my JWT stored?
No. The token is decoded in the browser and the page does not save it.