How it works

A JWT is three Base64URL segments joined by dots: header.payload.signature. This tool splits the token, decodes the header and payload as UTF-8 JSON, and pretty-prints both. Standard timestamp claims (iat, nbf, exp) are additionally rendered as UTC dates with a human-readable span. The Bearer prefix and any whitespace are tolerated.

Why the signature is not verified

It could be — this tool just doesn't do it, by design. Client-side verification is entirely possible for asymmetric signatures (RS/ES/PS): the issuer's public key is meant to be public, and browsers can verify via WebCrypto. HMAC (HS*) verification is different — it needs the issuer's secret key, which must never be shared with a client. Pinning and trusting a public key inside a browser tool is real work (key distribution, rotation, revocation), so this tool keeps a narrower contract: decode-only, read-only, zero secrets — you inspect the token's contents, and verification stays with your backend or a library like jsonwebtoken.

Privacy

Decoding happens entirely in your browser. Nothing is transmitted, logged, or stored — you can disconnect from the internet and keep using this page.

FAQ