JWT decode

When you debug a login session you need exp, role, or sub — without dropping the token on a random website.

Paste a Bearer Token or a raw JWT, click Decode JWT, and the right pane splits Header and Payload.

This page only decodes. It does not verify a signature and does not prove the token is valid. Production checks still use your server keys.

The token is handled in this browser only. Clear the input when you're done.

Anyone can read an unencrypted JWT Payload. This page helps you see claims. It does not prove they were not tampered with.

Nothing is uploaded, but the next person at the browser might still see it. Don't paste long-lived secrets on a public device.

How to use it

See when an access token expires.
Confirm role claims match what the gateway expects.
Compare Payload differences issued by two environments (copy, then Diff).
When the frontend sent a token and the backend says invalid, confirm you pasted the right one.

Does it verify the signature?

No. It only Base64-decodes so you can read claims.

Can I still read an expired token?

Yes. Whether a request is rejected is up to your gateway or backend.

Can encrypted JWT decode?

JWE and other encrypted tokens cannot. This page is for common three-part JWS.

Is the token uploaded?

No. Still avoid pasting long-lived secrets on a shared computer.

Do I have to strip Bearer?

No. A prefix is fine.

Can I edit the Payload and re-encode?

This page only decodes. Re-signing needs a key, and that belongs on the server.

What is kid in the header?

It often selects a verify key. This page only displays it and does not fetch JWKS.

How does this work with Format?

The decode result is JSON. Copy it to Format or Diff to keep reading.