Can this tool verify a token signature?

No. Signature verification requires the issuer's secret or public key. This tool decodes only — treat decoded content as untrusted until verified server-side.

Is it safe to paste a real token here?

Yes. Decoding runs entirely in your browser. No network request is made with your token.

What are the standard claims?

iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at), and jti (JWT ID).

Why does my token show fewer claims than expected?

Some tokens use compact or nested formats, or encrypt their payload (JWE). Encrypted tokens cannot be decoded without the decryption key.

JWT Decoder

Free online JWT decoder. Inspect JSON Web Token headers, claims, and expiry status — fully client-side, nothing is sent anywhere.

Free online JWT decoder. Inspect JSON Web Token headers, claims, and expiry status — fully client-side, nothing is sent anywhere. Copy a JWT from a login cookie, Authorization header, or session token. Paste it into the input and click "Decode Token". Review the algorithm, claims, signature size, and expiry status. Check registered claims like exp, iat, and nbf with human-readable dates. Decodes JWT header and payload segments locally using base64url decoding. Shows algorithm, type, claims, signature size, and expiry status. 100% client-side — tokens never leave your browser.