Does decoding a JWT verify its signature?

No. Decoding only reads the payload. Signature verification requires the secret or public key and is not the same as trusting the token. Always verify server-side before trusting claims.

The tool parses the exp, iat, and nbf claims and labels the token as EXPIRED, NOT YET VALID, or VALID (time claims). Timestamps are shown in ISO and local format.

What JWT formats are accepted?

Standard compact JWTs with three Base64URL segments separated by dots: header.payload.signature. JWE (encrypted) tokens are not supported.

Why does the payload show unexpected claims?

JWT payloads are Base64URL-decoded then JSON-parsed. If the issuer used custom claim names, they appear as-is. Registered claims (iss, sub, aud, exp, iat, nbf, jti) are not renamed.

Is my JWT uploaded anywhere?

No. Decoding happens entirely in your browser. However, JWTs often carry sensitive data — avoid pasting production tokens into any online tool you do not fully trust.

What does 'Note: Local decoding is not server-side signature verification' mean?

It reminds you that anyone can decode a JWT without the secret. Trusting claims requires verifying the signature with the issuer's secret or public key on a trusted server.

Decodificador de JWT

Decode and inspect JWT header, payload, and time claims with expiry status. Gratis, privado y 100% del lado del cliente.

Entrada

Probar un ejemplo:

Salida

La decodificación local no es verificación de firma del lado del servidor.Local only

Historial reciente

Sin historial aún

Uso

Paste the JWT into the input box.
Read the decoded header and payload.
Verificar the time-claim status and expiry note.

Tareas que usan esta herramienta

Decodificar and inspect a JWT safely

Paste un JSON Web Token, leer its encabezado y claims, y verificar expiry — mientras understanding exactly qué decodificación hace y hace no prove.

TAREA

Inspeccionar un JWT token: decodificar encabezado y payload sin verifying

Leer el estructura de un JSON Web Token a see its algoritmo, claims, y expiry — purely cliente-side, no servidor validation.

TAREA

Analizar OAuth 2.0 token responses

OAuth 2.0 returns access_token, token_type, expires_in, y optionally refresh_token. Aprender a analizar y usar el token respuesta correctly.

TAREA

Usar HTTP Basic Authentication

Basic Auth sends credenciales como Base64-encoded username:contraseña en el Authorization encabezado. Aprender el formatear, seguridad requirements, y alternatives.

TAREA

Usar Bearer tokens para API authentication

Bearer tokens son sent en el Authorization encabezado: "Bearer <token>". Whoever holds el token puede access el API — protect it como un contraseña.

TAREA

Usar JWT con RSA signatures (RS256)

RS256 signs JWTs con RSA-SHA256, providing asymmetric verification donde solo el privado clave holder puede sign pero anyone con el público clave puede verificar.

TAREA

Pipelines que usan esta herramienta

Decodificar JWT e inspeccionar payload

CANALIZACIÓN

Preguntas frecuentes

Does decoding a JWT verify its signature?: No. Decoding only reads the payload. Signature verification requires the secret or public key and is not the same as trusting the token. Always verify server-side before trusting claims.
How is expiry shown?: The tool parses the exp, iat, and nbf claims and labels the token as EXPIRED, NOT YET VALID, or VALID (time claims). Timestamps are shown in ISO and local format.
What JWT formats are accepted?: Standard compact JWTs with three Base64URL segments separated by dots: header.payload.signature. JWE (encrypted) tokens are not supported.
Why does the payload show unexpected claims?: JWT payloads are Base64URL-decoded then JSON-parsed. If the issuer used custom claim names, they appear as-is. Registered claims (iss, sub, aud, exp, iat, nbf, jti) are not renamed.
Is my JWT uploaded anywhere?: No. Decoding happens entirely in your browser. However, JWTs often carry sensitive data — avoid pasting production tokens into any online tool you do not fully trust.
What does 'Note: Local decoding is not server-side signature verification' mean?: It reminds you that anyone can decode a JWT without the secret. Trusting claims requires verifying the signature with the issuer's secret or public key on a trusted server.