JWT Decoder
Decode JWT header and payload without sending tokens away.
Interactive controls load with JavaScript. Processing stays in your browser—nothing is uploaded.
Betöltés…
Használat
- Open JWT Decoder — Open the tool page in your browser.
- Paste a JWT — Paste a JWS token (header.payload.signature). Prefer staging or expired tokens.
- Read claims — Inspect decoded header and payload JSON. Remember: decode ≠ verify.
- Clear when done — Clear the field and close the tab on shared computers.
Korlátok
Does not verify signatures or decrypt JWE. Reading exp/nbf does not enforce expiry—your server must.
When to use
Inspect claim shape locally during debugging without sending a production token to a random website.
When not to use
When you must cryptographically verify a token or unwrap JWE—use a trusted verifier with keys.
Privacy note
Decoding is local, but a JWT is still a credential—never paste live production tokens into untrusted sites.
References
GYIK（5）
Does decoding verify signatures?
No. This tool only Base64URL-decodes the JWT header and payload (JWS). It does not verify signatures (see RFC 7515 / RFC 7519). Verification needs your secret or public key on a trusted system.
Is my token uploaded?
No. Decoding runs in your browser. Still avoid pasting live production tokens into any third-party site—treat them like credentials.
Can it read encrypted JWTs (JWE)?
Encrypted JWTs are not plain JSON payloads. This decoder is for typical JWS tokens (header.payload.signature), not JWE decryption.
What about exp and nbf claims?
You can read exp/nbf timestamps here, but enforcement happens on your server. Reading a claim is not the same as rejecting an expired token.
Why might header or payload look wrong?
Check Base64URL padding and that you pasted all three segments. Corrupted or truncated tokens decode incorrectly.