Auth tool
JWT Decoder
Decode JWT headers and payloads locally, strip Bearer prefixes, humanize time claims, and make the signature status explicit.
JWT
Decoded claims
Runs in your browser
Tool guide
What this jwt decoder does
Use this JWT decoder when you need to inspect token claims while debugging authentication. It decodes the header and payload locally and clearly states that the signature has not been verified.
Common use cases
- Check a token expiration time while debugging auth.
- Inspect issuer, audience, subject, scope, and custom claims.
- Strip a Bearer prefix from a copied Authorization header.
- Compare token metadata with server logs or API responses.
Accepted input formats
JWT
header.payload.signature
Authorization header
Bearer header.payload.signature
Time claims
exp, iat, nbf
How it works
Toolvert base64url-decodes the header and payload in the browser. It does not verify the signature, so the result is useful for inspection, not trust decisions.
Common mistakes
- Decoded does not mean valid. Signature verification requires the right key or secret.
- Avoid pasting production tokens into shared screenshots or bug reports.
- An expired token may still decode successfully; check the exp claim.
JWT decoderdecode JWT onlineJWT token decoderJWT exp checker
FAQ
Frequently asked questions
Does this verify JWT signatures?
No. It decodes token contents only and labels the signature as not verified.
Can it read Bearer tokens?
Yes. It strips a leading Bearer prefix before decoding.
Does Toolvert store tokens?
No. Tokens are decoded locally and are not saved by default.