JWT Decoder Online — Inspect Header and Payload
Decode JWT headers and payloads locally in your browser. Inspect claims, timestamps and token structure without uploading the token or implying signature verification.
About this tool
This tool decodes the Base64URL header and payload segments of a JSON Web Token. It helps you inspect claims such as iss, sub, aud, exp and iat, but decoding alone does not prove who created the token or whether it was modified.
How to use
- Paste the complete three-part JWT into the input.
- Select Convert to decode the header and payload JSON.
- Review the claims and timestamps, remembering that the signature has not been verified.
Features
- Separates and decodes JWT header and payload data.
- Displays readable JSON claims without sending the token to a server.
- Clearly distinguishes decoding from cryptographic verification.
Common use cases
- Debug authentication and authorization integrations.
- Inspect issuer, audience, subject and expiration claims.
- Understand a token structure during API development.
Common issues and tips
- A JWT can look valid after decoding even when its signature is invalid or missing.
- Never paste production access or refresh tokens into tickets, chat messages or public bug reports.
Privacy
JWT decoding runs locally. The token is not uploaded, stored or verified by Tools12345.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes readable segments. Signature verification requires the expected algorithm, key and validation rules on a trusted server.
Can I trust the decoded claims?
Not until the signature and required claims have been validated. Anyone can construct or edit an unsigned payload.
What do exp and iat mean?
exp is the expiration time and iat is the issued-at time. They are normally represented as Unix timestamps in seconds.