JWT Decoder
Read header and payload. No signature check.
Loading tool
Paste a token and read the claims. Treat this as a viewer, not a verifier. Anyone can decode an unsigned payload.
How to use this tool
- Paste the snippet. Drop JSON, code, or a token into the input. It is not sent to a server.
- Run the action. Format, decode, or generate. Parse errors stay on the page.
- Copy the output. Copy the result back into your editor or terminal.
Verification
Signature bytes are displayed as Base64url only. This page never has your HMAC secret or private key, and it will not tell you the token is authentic.
Frequently asked
Why is exp shown in the past?
The token is expired. That is a claim, not proof it was ever valid.
Can I edit claims and re-sign?
No. Editing would be forging. Use your own issuer.
Are encrypted JWEs supported?
No. Compact JWS with three parts is expected.
Is the token sent to a debugger API?
No. Decoding is local.
What about algorithm none?
The header is shown as-is. A none alg is a red flag in production.