Does this verify the JWT signature?

No by default. Decoding only Base64URL-parses the header and payload. Optional Advanced HS256/HS384/HS512 verify checks an HMAC secret you paste locally — it still does not validate iss, aud, or JWKS.

Why is alg=none dangerous?

A token with `"alg":"none"` has no cryptographic signature. Anyone can forge claims. Reject unsigned JWTs in production verifiers.

Can I inspect expired tokens?

Yes. The tool shows `exp`, `iat`, and `nbf` with local time, ISO, and relative badges even when expired.

Should I paste production access tokens?

Decoding runs locally and tokens are not uploaded, but avoid pasting live secrets into any tool you do not control, and never put tokens in shared URLs.

JWT Decoder Online

Inspect JSON Web Tokens

Paste a JWT to decode its Base64URL header and payload as formatted JSON. Inspect claims, roles, and expiration without verifying the signature.

Decoding shows claims only — it is not signature verification. Tokens stay in your browser and are never uploaded.

Segments0/3

What is this tool?

This JWT decoder reads the header and payload segments of a JSON Web Token and formats them as pretty JSON. JWTs are compact Base64URL parts separated by dots, commonly used for OAuth/OIDC access tokens, session claims, and API authorization debugging.

Decoding is inspection only. It does not fetch JWKS, validate iss/aud, enforce algorithm allow-lists, or prove who signed the token. An optional Advanced panel can check HS256/HS384/HS512 against a secret you paste locally — still not a full production verifier.

Use it when you need to see claim shape, kid, roles/scopes, and exp/iat/nbf timing without sending the token to a server.

Common use cases

Debug why an API rejects a bearer token (expired exp, wrong aud shape, unexpected alg)
Inspect IdP-issued claims (sub, roles, scopes) during OAuth/OIDC integration
Confirm kid and header fields before wiring JWKS verification in your app

How to use

Paste a compact JWT (header.payload.signature). A leading Bearer is stripped automatically. Results update live.
Read segment count (n/3), alg, and time-claim badges for exp/iat/nbf (local time, ISO, relative).
Copy header or payload JSON separately.
Optionally open Advanced and paste an HMAC secret to verify HS* signatures only. Use a real library/JWKS flow when you need full trust decisions.

Examples

Input / setting	Output	Notes
Sample button (HS256)	Header `alg: HS256`; payload with `sub`, `role`, `iat`/`nbf`/`exp`	Secret for Advanced verify: `utill-sample-secret`.
`eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjMifQ.`	Header `alg: "none"`; payload `{"sub":"123"}`	Unsigned edge case — warning shown; do not trust.
`Bearer eyJ…` (any valid JWT)	Same decode as without prefix	Authorization-header paste convenience.
Token with past `exp`	Payload JSON + Expired badge	Inspection still works; expired ≠ unverifiable claims.

Practical pitfalls

Decode ≠ verify: pretty JSON never proves integrity or authenticity.
alg=none or algorithm confusion attacks are real — production verifiers must pin allowed algorithms and require signatures.
Unique to this page vs many dump-only decoders: optional local HS* check stays collapsed so the default path stays decode-only and safer to reason about.
Never put live access tokens in shared URLs or screenshots with secrets.

References

Last reviewed: 2026-07-26

Frequently asked questions

Does this verify the JWT signature?: No by default. Decoding only Base64URL-parses the header and payload. Optional Advanced HS256/HS384/HS512 verify checks an HMAC secret you paste locally — it still does not validate iss, aud, or JWKS.
Why is alg=none dangerous?: A token with `"alg":"none"` has no cryptographic signature. Anyone can forge claims. Reject unsigned JWTs in production verifiers.
Can I inspect expired tokens?: Yes. The tool shows `exp`, `iat`, and `nbf` with local time, ISO, and relative badges even when expired.
Should I paste production access tokens?: Decoding runs locally and tokens are not uploaded, but avoid pasting live secrets into any tool you do not control, and never put tokens in shared URLs.