Does JWT Decoder verify token signatures?

No. This tool decodes header and payload only for inspection. Signature verification requires the secret key and proper cryptographic libraries. Never trust a JWT's claims without verified signature.

What does 'invalid token' mean?

A JWT must have three parts separated by dots (header.payload.signature). If you see this error, check for: missing or extra dots, invalid Base64URL encoding, or pasting the full token including 'Bearer ' prefix.

How do I check if a token has expired?

After decoding, look for the 'exp' (expiration) claim in the payload. The value is a Unix timestamp in seconds. Compare it to the current time. If exp < now, the token is expired.

Can I decode JWTs from any algorithm (HS256, RS256, ES256)?

Yes. The decode tool works with any algorithm because it only reads the Base64URL-encoded header and payload. Signature verification is separate and not implemented here.

Which tools pair well with JWT Decoder?

Common next steps include Hash Generator, Base64 Encode/Decode. These related tools help continue the same workflow through generation, validation, formatting, or debugging.

Last reviewed: 2026-05-15

JWT Decoder quick answer

JWT Decoder Base64URL-decodes header and payload only. It never verifies signatures, so a readable token is not proof of authenticity.

Read exp/iss/aud on a sandbox access token before wiring middleware.
Confirm alg is RS256 when a vendor console still labels the key HS256.
Strip a pasted “Bearer ” prefix if the tool reports an invalid token shape.

This text tool is local-first in the browser and does not store your input for normal conversion workflows.

JWT Decoder returns a copyable result that can be reviewed immediately or continued in a related ToolMeshly workflow.

Example

Example input and output

Input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.signature

Output

Header and payload claims decoded as JSON.

Best for

Inspecting token claims
Checking exp/iat timestamps
Debugging OAuth payloads

Not for

Authenticating a token
Verifying production signatures

JWT Decoder reads token header and payload claims for debugging; decoding is not authentication.

About JWT Decoder

Decode and inspect JWT (JSON Web Token) header and payload. Note: signature is not verified.

Paste your JWT token in the input area.
Click Run to decode the token.
Review the decoded header section.
Review the decoded payload claims.
Check token expiration time (exp claim) if present.
Note: This tool does NOT verify the token signature.

FAQ

What is JWT Decoder best for?: Decode and inspect JWT (JSON Web Token) header and payload. Note: signature is not verified.
Does JWT Decoder upload or store my data?: This text tool is local-first in the browser and does not store your input for normal conversion workflows.
Does JWT Decoder verify token signatures?: No. This tool decodes header and payload only for inspection. Signature verification requires the secret key and proper cryptographic libraries. Never trust a JWT's claims without verified signature.
What does 'invalid token' mean?: A JWT must have three parts separated by dots (header.payload.signature). If you see this error, check for: missing or extra dots, invalid Base64URL encoding, or pasting the full token including 'Bearer ' prefix.
How do I check if a token has expired?: After decoding, look for the 'exp' (expiration) claim in the payload. The value is a Unix timestamp in seconds. Compare it to the current time. If exp < now, the token is expired.
Can I decode JWTs from any algorithm (HS256, RS256, ES256)?: Yes. The decode tool works with any algorithm because it only reads the Base64URL-encoded header and payload. Signature verification is separate and not implemented here.
Which tools pair well with JWT Decoder?: Common next steps include Hash Generator, Base64 Encode/Decode. These related tools help continue the same workflow through generation, validation, formatting, or debugging.

Was this tool useful?

Your feedback helps us improve examples, workflows, and edge cases.

Report issue Request feature

Recommended workflow

Continue this task as a workflow

Use curated tool chains to finish the broader job with fewer searches.

Workflow

Inspect a JWT token

Decode token claims, inspect base64 payloads, and convert expiry timestamps.

JWT Decoder→Base64 Encode/Decode→Timestamp Converter

Related Tools

Hash Generator Base64 Encode/Decode

Guides & tutorials

JWT Decoder

Local processing

Inspect JWT header and payload (signature not verified).

Input

Shortcuts: ⌘/Ctrl+Enter run · ⌘/Ctrl+Shift+C copy · ⌘/Ctrl+Z undo