Does this verify the signature?

No — verifying a signature requires the secret or public key, which this tool never asks for. It only decodes the header and payload, which are not encrypted in a standard JWT, just base64url-encoded.

Is the token sent to a server?

No — decoding happens entirely in your browser.

Why does my token have no expiry badge?

The token has no exp claim — not all JWTs include one.

JWT Decoder

Paste a JWT to see its decoded header and payload, and whether it has expired — all computed locally.

JWT

This only decodes the token locally — it is never sent to a server, and the signature is never verified (that would require a secret or public key this tool never asks for).

Signature present (not verified)No expiry claim

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Processing happens locally in your browser. Nothing you enter is uploaded.

How It Works

Paste a JWT (header.payload.signature). The decoded header and payload appear immediately, along with an expiry check based on the exp claim if present.

Example

The token "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.sig" decodes to header {"alg":"HS256"} and payload {"sub":"1234567890"}.

Frequently Asked Questions

Does this verify the signature?: No — verifying a signature requires the secret or public key, which this tool never asks for. It only decodes the header and payload, which are not encrypted in a standard JWT, just base64url-encoded.
Is the token sent to a server?: No — decoding happens entirely in your browser.
Why does my token have no expiry badge?: The token has no exp claim — not all JWTs include one.

Related Tools

Password Generator