Is it safe to paste my JWT here?

Yes. All decoding happens locally in your browser. The token is never sent to any server.

Can this verify the JWT signature?

No. Signature verification requires the secret key or public key, which this tool does not have. This tool only decodes the token.

A JWT has three Base64URL-encoded parts separated by dots: the header (algorithm), the payload (claims/data), and the signature (for verification).

// jwt-decoder

Decode and inspect JSON Web Tokens (JWT). View header, payload, and signature.

JWT Token

Paste token-Paste a JWT token into the input field.
View decoded-The header, payload, and signature are displayed in separate sections.
Check expiration-The token's expiration status is shown with issued/expiry timestamps.

JWT Decoder parses JSON Web Tokens into their three components: header (algorithm and type), payload (claims and data), and signature.

It automatically detects expiration timestamps (exp, iat, nbf) and shows whether the token is currently valid or expired.

This tool only decodes tokens — it does not verify signatures. All decoding happens locally in your browser.

Base64 Encode / Decode

Encode text or files to Base64, or decode Base64 strings.

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text or files.