Can this tool verify JWT signatures?

No. Decoding extracts the header and payload, which are not encrypted. Signature verification requires the secret or public key and is not performed — this tool only inspects the token contents.

Is it safe to paste my JWT here?

Yes. Everything runs in your browser. Your token never leaves your device. However, treat your JWT like a password — anyone who has it can impersonate you until it expires.

What are the three parts of a JWT?

Header, payload, and signature, separated by dots. Header describes the algorithm and type. Payload contains the claims (user ID, roles, expiry, etc.). Signature verifies that the token has not been tampered with.

Why does my token show as expired?

The exp claim sets the expiration time. If exp is earlier than now, the token should not be accepted by any server. Some services still accept slightly expired tokens within a grace period — but that is server-specific.

What is the difference between decoding and verifying a JWT?

Decoding is just Base64URL decoding — anyone can read the header and payload. Verifying recomputes the signature using the secret (HMAC) or public key (RSA/ECDSA) and checks that the token has not been forged or tampered with. Never trust a decoded JWT until it is verified.

Where is the JWT usually stored on the client?

Two common options: in memory (safest, lost on refresh), or in an httpOnly cookie (safe from XSS but requires CSRF protection). localStorage is common but vulnerable to any XSS — avoid it for sensitive applications.

JWT Decoder

Paste a JWT and see its header, payload, signature and expiry decoded in one view. Checks whether the token is still valid or has expired. Runs entirely in your browser — nothing is logged, stored or sent anywhere.

How to use

Paste your JWT

Paste a token — three Base64URL parts separated by dots.

Read the header

See the algorithm and token type.

Read the payload

See the claims: user ID, roles, expiry, issued-at, and any custom data.

Check the expiry

See if the token is still valid or has expired.

JWT token

Features

Header, payload and signature

All three parts of the JWT are decoded and displayed.

Expiry check

Shows whether the token is valid or expired, with the exact expiry time.

Issued-at display

See when the token was issued.

Algorithm display

See which signing algorithm the token uses.

Common use cases

Debug an authentication token from an API
Check when a JWT expires
Inspect the claims in a token without verifying the signature
Understand the structure of a JWT

Frequently Asked Questions

Related tools

JWT Encoder

Base64 Encoder & Decoder

Hash Generator

JSON Formatter & Validator