Runs entirely in your browser — nothing leaves this page.
JWT decoder
Header, claims and expiry status. Signature is not verified.
the signature is not verified — this tool inspects, it does not authenticate
What this decoder does and does not do
A JWT is three base64url segments: header, claims and signature. This tool splits and decodes the first two so you can read what a token actually asserts — issuer, subject, scopes, expiry — without pasting it into a terminal.
The signature is not verified. Verification needs the issuer's key, and a tool that asked you for it would be asking for the wrong thing.
Why not verify the signature?
Because verification requires the secret or public key, and handing either to a web page is a bad habit to build. Decoding answers the questions you usually have — has it expired, which audience is it for, what scopes does it carry — and none of those need the key.
Is it safe to paste a token here?
The decoding happens in your browser and nothing is transmitted. That said, a live access token is a credential: if it is a production token from someone else's system, treat pasting it anywhere as an event worth thinking about.
The token looks valid — why does the API reject it?
Check exp against the current time first — clock skew between services is the usual cause. After that, check aud and iss: a token minted for one audience is correctly rejected by another, and the claims here show you which is which.
Are the claims encrypted?
No. A standard JWT is signed, not encrypted — anyone holding it can read every claim, exactly as this page does. Never put anything in a JWT that the bearer should not see.
Related tools: Base64, Timestamp and Password leak check.