Does decoding a JWT verify it is valid?

No. Decoding only reads the header and payload; it does not check the signature, so a decoded token can still be expired or tampered with.

Is it safe to paste a production token here?

Decoding happens entirely in your browser and the token is never uploaded, but treat any live token as sensitive and avoid pasting one you would not want exposed on screen.

JWT Decoder

Paste a JSON Web Token to see its header and payload decoded into readable JSON. Useful for checking claims such as expiry or subject while debugging authentication.

JWT Token

⚠️ This tool only decodes JWT. Signature verification is not performed. Use with caution for sensitive tokens.

Common Claims

iss - Issuersub - Subjectaud - Audienceexp - Expirationnbf - Not Beforeiat - Issued At

How to use

Paste a JWT into the input field.
The header and payload decode automatically.
Read or copy the decoded claims.

Frequently asked questions

Does decoding a JWT verify it is valid?: No. Decoding only reads the header and payload; it does not check the signature, so a decoded token can still be expired or tampered with.
Is it safe to paste a production token here?: Decoding happens entirely in your browser and the token is never uploaded, but treat any live token as sensitive and avoid pasting one you would not want exposed on screen.

Privacy

The token is decoded in your browser and is never sent to a server.