Auth search tool
decode JWT online
Paste a JWT or Bearer token to inspect the decoded header and payload. Toolvert makes clear that the signature is not verified.
Examples for this search
Decode exp, iat, and nbf.
Inspect issuer and audience.
Strip Bearer automatically.
Toolvert base64url-decodes the header and payload in the browser. It does not verify the signature, so the result is useful for inspection, not trust decisions.
What this jwt decoder does
Use this JWT decoder when you need to inspect token claims while debugging authentication. It decodes the header and payload locally and clearly states that the signature has not been verified.
Common use cases
- Check a token expiration time while debugging auth.
- Inspect issuer, audience, subject, scope, and custom claims.
- Strip a Bearer prefix from a copied Authorization header.
- Compare token metadata with server logs or API responses.
Accepted input formats
header.payload.signature
Bearer header.payload.signature
exp, iat, nbf
How it works
Toolvert base64url-decodes the header and payload in the browser. It does not verify the signature, so the result is useful for inspection, not trust decisions.
Common mistakes
- Decoded does not mean valid. Signature verification requires the right key or secret.
- Avoid pasting production tokens into shared screenshots or bug reports.
- An expired token may still decode successfully; check the exp claim.
Frequently asked questions
Does this verify JWT signatures?
No. It decodes token contents only and labels the signature as not verified.
Can it read Bearer tokens?
Yes. It strips a leading Bearer prefix before decoding.
Does Toolvert store tokens?
No. Tokens are decoded locally and are not saved by default.