No. This tool only Base64URL-decodes the JWT header and payload (JWS). It does not verify signatures (see RFC 7515 / RFC 7519). Verification needs your secret or public key on a trusted system.
Is my token uploaded?
No. Decoding runs in your browser. Still avoid pasting live production tokens into any third-party site—treat them like credentials.
Can it read encrypted JWTs (JWE)?
Encrypted JWTs are not plain JSON payloads. This decoder is for typical JWS tokens (header.payload.signature), not JWE decryption.
What about exp and nbf claims?
You can read exp/nbf timestamps here, but enforcement happens on your server. Reading a claim is not the same as rejecting an expired token.
Why might header or payload look wrong?
Check Base64URL padding and that you pasted all three segments. Corrupted or truncated tokens decode incorrectly.
Developer
JSON Formatter — Beautify, minify and validate JSON in your browser with LocalKit. Catch syntax errors locally—no upload, no account, ideal for API payloads and config drafts.
Base64 Encode / Decode — Encode or decode Base64 text entirely in your browser with LocalKit. Handy for data URLs and tokens—processing stays on-device with nothing uploaded for computation.
URL Encode / Decode — Percent-encode or decode URL components locally in LocalKit. Prepare query strings and path segments without sending text to a remote encoder or creating an account.
Hash Generator — Compute MD5, SHA-1, SHA-256 and more digests locally in LocalKit. Verify checksums in your browser—hashes never leave your device and no account is required.
UUID Generator — Generate UUID v4 identifiers in bulk inside your browser with LocalKit. Create test IDs offline—nothing is uploaded for computation and no signup is needed.
Password Generator — Generate strong random passwords offline with Web Crypto in LocalKit. Optional ambiguous-character exclusion—secrets stay on-device with no account or upload.