A JWT is three Base64Url-encoded segments joined by dots — header, payload, and signature — and decoding the first two is just reversing that encoding, no cryptography involved. Verifying the signature is a completely different operation that requires the issuer's secret or public key, which is why this tool is a decoder and inspector only: it shows you what's inside a token, not whether the signature is genuine. See JWT Tokens Explained for why that distinction is a real security point, not just a feature limitation.
What you get after decoding
The header and payload are parsed and displayed as raw, formatted JSON — algorithm, token type, and whatever claims the issuer put in the payload (sub, roles, exp, iat, custom claims, etc.), exactly as they're encoded in the token. Timestamp claims like exp and iat are shown as the raw Unix epoch numbers from the token, not converted to a human-readable date automatically — if you need the actual date, pasting the number into any epoch-to-date converter (or your browser's console: new Date(1735689600 * 1000)) takes a few seconds.
Why this tool doesn't verify signatures
Verifying an HS256 signature needs the shared secret; verifying RS256 needs the issuer's public key. Neither of those belongs in a public browser tool — asking you to paste a signing secret into any website, even one that's genuinely local-only, is a bad security habit to build regardless of how the tool actually works. If you need to verify a signature, do it in your own backend or CLI where the key already lives securely.
Common uses
- Checking that
tenant_id,role, or other custom claims are actually present and correctly shaped in a token your auth provider issued - Reading the
expclaim to diagnose an unexpected 401/403 in a frontend app - Confirming which signing algorithm (
alg) a token uses without touching a backend - Inspecting a token pulled from browser dev tools or a request log to understand what a service is sending
FAQ
Does this tool verify the signature?
No — it decodes and displays the header and payload only. Verifying a signature requires the issuer's secret (HS256) or public key (RS256), which this tool intentionally doesn't ask for.
Does it convert exp/iat into a readable date automatically?
Not currently — those claims are shown as the raw Unix timestamp from the token, the same way every other claim is shown. You'll need to convert the number separately if you want a calendar date.
What's the difference between a malformed token and an expired one?
A malformed token fails to decode at all (wrong number of segments, invalid Base64) and shows a parsing error. An expired token decodes fine — the exp timestamp is just in the past. This tool only tells you the raw value; comparing it to the current time is on you.
Is my token sent to a server?
No. The token is split and Base64Url-decoded entirely in your browser using native JavaScript — nothing is uploaded.