Expires in 2445d 10h
5/18/2033, 3:33:20 AM
HEADER: ALGORITHM & TOKEN TYPE
{
"alg": "HS256",
"typ": "JWT"
}VERIFY SIGNATURE
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cSignature verification requires your private/secret key. Token content is decoded offline without verifying the secret.
PAYLOAD: DATA & CLAIMS
{
"sub": "1234567890",
"name": "Toolbase User",
"role": "admin",
"iat": 1700000000,
"exp": 2000000000
}How to Use JWT Decoder Without Sending Your Token
The Security Problem With Online JWT Decoders
JWT tokens contain sensitive information: user IDs, permissions, session data, and sometimes even PII. Pasting them into most online decoders sends the token to a third-party server, creating a potential security breach.
This decoder runs entirely in your browser. It splits the JWT into its three parts (header, payload, signature), decodes each from Base64, and displays the contents with syntax highlighting. It also shows the token's expiration status, issued-at time, and any custom claims. Your token never leaves your machine.
Frequently Asked Questions
It can decode and display the signature, but full cryptographic verification requires the secret key, which should never be pasted into a web tool.