About Decode JWT
Use the JWT decoder online to inspect JWT header and claims during debugging. Decoding only reveals data supplied by the token; it does not establish trust. The JSON result always states that the signature is unverified, and this tool is excluded from workspace recovery.
How to decode a compact JWT for inspection
- Paste a three-part compact JWT without a Bearer prefix.
- Select Process to decode its JSON header and payload.
- Read the unverified warning and inspect the data without using it to authorize a request.
A practical example
- Input
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.c2ln
- Result
{ "signatureVerified": false, "warning": "Decoded only. Do not trust these claims without signature and claim validation.", "header": { "alg": "HS256" }, "claims": { "sub": "123" } }
The example signature is illustrative and is not valid. Decoding succeeds without verifying it.
Supported input and limitations
- Input is limited to 64 KB. Only three-part compact JWTs with JSON-object headers and payloads are accepted; encrypted JWEs are not supported.
- No signature, algorithm policy, issuer, audience, expiration, or revocation check is performed. Never grant access based on decoded data. Workspace recovery excludes this tool.
Processing happens on your device. Read about local processing and optional workspace recovery.
Frequently asked questions
Does decoding a JWT verify its signature?
No. The result explicitly sets signatureVerified to false. Authenticity requires trusted keys, algorithm restrictions, and signature validation outside this decoder.
Can this tool tell whether a JWT is expired?
It displays any exp claim as supplied but does not validate time claims or token validity. A token can be invalid for many reasons beyond expiration.