Why isn't the signature verified?

Verification requires the signing key, which we don't have. Use your server's secret or the JWKS endpoint to verify trust.

Is my JWT secure to paste here?

Tokens can grant access — only paste tokens you're OK seeing, or test tokens. Nothing leaves your browser, but be cautious.

JWT Decoder

Paste a JWT and see the header, payload, expiry, and signature parts decoded. Everything happens in your browser.

tool.jwt-toolkit.jwtToken

tool.jwt-toolkit.headerLabel

tool.jwt-toolkit.payloadLabel

Was this tool helpful?

Send output to:

How to use JWT Decoder

Paste a JWT token.
Read the decoded header and payload.
Check the expiry hint.

What is JWT Decoder?

JWTs are three Base64URL-encoded parts separated by dots: header.payload.signature. This tool decodes the first two and shows the third, plus computes expiry from iat and exp claims. The signature is NOT verified — that requires the issuer's secret or public key.

FAQ

Why isn't the signature verified?: Verification requires the signing key, which we don't have. Use your server's secret or the JWKS endpoint to verify trust.
Is my JWT secure to paste here?: Tokens can grant access — only paste tokens you're OK seeing, or test tokens. Nothing leaves your browser, but be cautious.

Related tools

Author

Marcus Webb"The DevTool Craftsman"

Full-Stack Developer & Tools Architect

Marcus has been writing code since the dial-up era. He has contributed to open-source developer tools, built CI/CD pipelines for startups, and debugged production incidents at 3 AM more times than he would like to admit. His philosophy is that the best developer tool is the one that gets out of your way, and he writes about practical tooling that helps teams ship faster with fewer headaches.

📖 JWT Decoder on Wikipedia·Developer Tools on Wikipedia·JWT Decoder on Britannica

People also use

← Back to Developer Tools · All tags