Why no signature verification?

This tool inspects structure and claims locally. Verification also requires a trusted key, algorithm restrictions and issuer information. Asymmetric signatures normally use a public verification key; decoding is not verification.

The tool says exp has passed, but the server still accepts it — why?

Check clock differences, configured leeway and whether the server actually validates exp. iat and nbf have separate meanings and do not replace expiration checks.

Not supported. JWE has five segments (not three) and needs decryption, not just decoding.

Does the displayed exp prove a token is usable?

No. Anyone can edit a payload. Its claims are meaningful only after verifying a trusted issuer's signature and the required claims.

Should I send a real token to someone for debugging?

Avoid doing so. A token may contain personal information or usable access credentials. Prefer redacted data or the example, and treat decoded output as sensitive too.

JWT decoder

Split a JWT and decode Header / Payload (no signature check)

Computed in your browser

Paste a three-part token and decode its header and payload. This page does not verify signatures or establish that a login credential is valid.

JWT

Header

Payload

Signature status

–

Example

Input

eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0.

Example result

Header: {"alg":"none"}
Payload: {"sub":"demo"}

This unsigned teaching example must not be used for authentication.

Technical details & limits

Compact JWS joins Base64URL header, payload and signature segments with dots. NumericDate claims such as exp use seconds. Decoding and browser-clock checks do not replace server validation of signatures, allowed algorithms, iss, aud, nbf and exp. Five-part JWE is not supported.

About this tool

Decode the header and payload of a three-part JWT locally and display readable JSON. Inspect fields such as alg, sub and exp. The tool does not verify signatures or authorize access.

Use cases

Debug an auth flow by seeing what the client actually received.
Check whether a token’s exp has already passed.
Paste an example JWT decoding into documentation.

How to use

Paste the JWT (aaa.bbb.ccc) into the input.
Click Decode to display the header and payload. Valid JSON is formatted automatically.

Notes

Signature verification is not implemented here. Production systems need trusted verification keys, an allowed algorithm and complete claim checks.

FAQ

Why no signature verification?: This tool inspects structure and claims locally. Verification also requires a trusted key, algorithm restrictions and issuer information. Asymmetric signatures normally use a public verification key; decoding is not verification.
The tool says exp has passed, but the server still accepts it — why?: Check clock differences, configured leeway and whether the server actually validates exp. iat and nbf have separate meanings and do not replace expiration checks.
What about JWE?: Not supported. JWE has five segments (not three) and needs decryption, not just decoding.
Does the displayed exp prove a token is usable?: No. Anyone can edit a payload. Its claims are meaningful only after verifying a trusted issuer's signature and the required claims.
Should I send a real token to someone for debugging?: Avoid doing so. A token may contain personal information or usable access credentials. Prefer redacted data or the example, and treat decoded output as sensitive too.

Related tools

JWT decoder · Split a JWT and decode Header / Payload (no signature check) — JWT decoder — Tool illustration · dayeku.com