JWT Decoder

Frequently asked questions

Does this tool verify the token's signature?

No. This tool only decodes the header and payload segments — it never verifies a signature or proves the claims are trustworthy. Signature verification requires the issuer's secret or public key, which this tool never asks for or has access to.

Is my token uploaded anywhere?

No. Decoding happens entirely in your browser. The token is never sent to a server, never logged, never stored in your recent-tools history, and never placed in the page URL.

Why does it say "Token structure decoded" instead of "Valid JWT"?

Because decoding the header and payload only tells you the token is well-formed — it says nothing about whether the signature is genuine. Only the token's issuer, or a verifier with the correct key, can confirm that.

What does an expired or not-yet-active warning mean?

The Claims tab compares the token's exp (expiration) and nbf (not before) claims, if present, to the current time and flags tokens that are expired or not yet valid.

Does it work with a "Bearer" prefix?

Yes — pasting a full Authorization header value like "Bearer eyJ..." works; the prefix is stripped automatically before decoding.

You might also need

What is the JWT Decoder?

The JWT Decoder decodes a JSON Web Token's header and payload segments directly in your browser, so you can inspect its claims without pasting it into a third-party website. It never verifies the signature and never claims a token is valid — only that its structure was decoded.

Use cases

• Inspecting the claims inside an access token or ID token while debugging an OAuth/OIDC flow
• Checking whether a token has expired or is not yet active
• Reviewing custom claims added by an identity provider before wiring up backend verification
• Understanding the structure of a JWT for the first time

How to use the JWT Decoder

1. 1

   Paste the token

   Paste a JWT into the input — a leading "Bearer " prefix is stripped automatically.

2. 2

   Decode

   Click Decode JWT (or press Ctrl/Cmd+Enter) to split and decode the header and payload.

3. 3

   Review the claims

   Switch to the Claims tab to see issuer, subject, audience, and expiry/not-before status at a glance.

Examples

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.sig

{
  "alg": "HS256",
  "typ": "JWT"
}