Does decoding a JWT verify its signature?

No. Decoding only reads the payload. Signature verification requires the secret or public key and is not the same as trusting the token. Always verify server-side before trusting claims.

The tool parses the exp, iat, and nbf claims and labels the token as EXPIRED, NOT YET VALID, or VALID (time claims). Timestamps are shown in ISO and local format.

What JWT formats are accepted?

Standard compact JWTs with three Base64URL segments separated by dots: header.payload.signature. JWE (encrypted) tokens are not supported.

Why does the payload show unexpected claims?

JWT payloads are Base64URL-decoded then JSON-parsed. If the issuer used custom claim names, they appear as-is. Registered claims (iss, sub, aud, exp, iat, nbf, jti) are not renamed.

Is my JWT uploaded anywhere?

No. Decoding happens entirely in your browser. However, JWTs often carry sensitive data — avoid pasting production tokens into any online tool you do not fully trust.

What does 'Note: Local decoding is not server-side signature verification' mean?

It reminds you that anyone can decode a JWT without the secret. Trusting claims requires verifying the signature with the issuer's secret or public key on a trusted server.

Décodeur JWT

Decode and inspect JWT header, payload, and time claims with expiry status. Gratuit, privé et 100% côté client.

Entrée

Essayer un exemple:

Sortie

Le décodage local n'est pas une vérification de signature côté serveur.Local only

Historique récent

Aucun historique

Utilisation

Paste the JWT into the input box.
Read the decoded header and payload.
Vérifier the time-claim status and expiry note.

Tâches utilisant cet outil

Décoder and inspect a JWT safely

Paste un JSON Web Jeton, lire its en-tête et claims, et vérifier expiry — pendant que understanding exactly quoi décodage fait et fait non prove.

TÂCHE

Inspecter un JWT jeton: décoder en-tête et payload sans verifying

Lire le structure de un JSON Web Jeton en see its algorithme, claims, et expiry — purely client-side, aucun serveur validation.

TÂCHE

Analyser OAuth 2.0 token responses

OAuth 2.0 returns access_token, token_type, expires_in, et optionally refresh_token. Apprendre en analyser et utiliser le jeton réponse correctly.

TÂCHE

Utiliser HTTP Basic Authentication

Basic Auth sends identifiants comme Base64-encoded username:mot de passe en le Authorization en-tête. Apprendre le formater, sécurité requirements, et alternatives.

TÂCHE

Utiliser Bearer tokens pour API authentication

Bearer tokens sont sent en le Authorization en-tête: "Bearer <token>". Whoever holds le jeton peut access le API — protect it comme un mot de passe.

TÂCHE

Utiliser JWT avec RSA signatures (RS256)

RS256 signs JWTs avec RSA-SHA256, providing asymmetric verification où seulement le privé clé holder peut sign mais anyone avec le public clé peut vérifier.

TÂCHE

Pipelines utilisant cet outil

Décoder JWT et inspecter la charge utile

PIPELINE

Questions fréquentes

Does decoding a JWT verify its signature?: No. Decoding only reads the payload. Signature verification requires the secret or public key and is not the same as trusting the token. Always verify server-side before trusting claims.
How is expiry shown?: The tool parses the exp, iat, and nbf claims and labels the token as EXPIRED, NOT YET VALID, or VALID (time claims). Timestamps are shown in ISO and local format.
What JWT formats are accepted?: Standard compact JWTs with three Base64URL segments separated by dots: header.payload.signature. JWE (encrypted) tokens are not supported.
Why does the payload show unexpected claims?: JWT payloads are Base64URL-decoded then JSON-parsed. If the issuer used custom claim names, they appear as-is. Registered claims (iss, sub, aud, exp, iat, nbf, jti) are not renamed.
Is my JWT uploaded anywhere?: No. Decoding happens entirely in your browser. However, JWTs often carry sensitive data — avoid pasting production tokens into any online tool you do not fully trust.
What does 'Note: Local decoding is not server-side signature verification' mean?: It reminds you that anyone can decode a JWT without the secret. Trusting claims requires verifying the signature with the issuer's secret or public key on a trusted server.