JWT Decoder
Inspect token headers and claims. Signatures are not verified.
Private by design
Your inputs stay on your device and are not sent to our servers. Optional usage analytics does not receive your files or tool inputs.
How to use JWT Decoder
- Paste a token, optionally including the Bearer prefix, and decode it. Signed-token structures have three segments; encrypted JWE structures have five.
- Read the protected header and readable JSON payload. Registered time claims show UTC dates and unverified expiry/not-before status.
- Copy decoded JSON if needed, review warnings, and clear the token when finished. Never use this output to grant access or establish identity.
What are the limits of JWT Decoder?
This is decoding, not signature verification, authentication, authorization or decryption. Encrypted JWE payloads remain opaque; only their protected header and segment sizes are displayed. No keys, remote key URLs or JWKS are fetched. Unsupported unencoded payloads, malformed base64url/UTF-8/JSON, duplicate keys and excessive size/depth are rejected. Tokens are limited to 64 KB with bounded header/payload JSON. Claims remain untrusted even when their dates are in the future. Raw number literals are preserved; claim date display has millisecond precision. Nothing is uploaded or persisted.