Paste a JWT to decode and inspect its header, payload, and signature.
Powered by Ubikon Technologies | All processing happens in your browser. No data is sent to any server.
Paste a JWT and the tool splits it on its two dots into header, payload, and signature segments, base64url-decodes the header and payload, and parses each as JSON for display. It also reads the exp claim (if present) against your device's clock to show whether the token is expired. It does not and cannot verify the signature — that requires the signing secret, which never reaches the browser.
Input (sample token)
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.signature
Decoded payload
{
"sub": "1234567890",
"name": "John Doe"
}Does this tool verify the JWT signature?
No, and it cannot — verifying a signature requires the secret or public key the token was signed with, which is never available in the browser for a token you paste in. This tool only base64url-decodes the header and payload segments and displays the signature segment as-is; it does not check whether the signature is valid.
How does the decoder handle the token's three parts?
A JWT is three base64url segments joined by dots: header.payload.signature. The tool splits on the dots (rejecting anything without exactly 3 parts), base64url-decodes the header and payload with a UTF-8-aware decoder (so non-ASCII claim values like accented names decode correctly), and parses each as JSON.
What does the "Valid / Expired" status mean?
It compares the payload's exp claim (if present) against the current time on your device. If exp is in the past, it shows "Expired"; if it is in the future, "Valid (not expired)"; if there is no exp claim at all, it shows "No expiration claim". This checks only the claim's timestamp, not the signature.
Is my token sent to a server to decode?
No. Splitting, base64url-decoding, and JSON-parsing all happen in your browser with plain JavaScript — the token never leaves the page.