Inspect a JWT locally.
Decode the readable parts of a JSON Web Token without transmitting it.
🔒 Processed locallyYour input stays on this device and is never uploaded to Boring Tools.
Result
How to use JWT Decoder
A JWT contains Base64URL-encoded header and payload segments plus a signature. Decoding displays claims but does not prove that the signature is valid.
Steps
- Paste a token.
- Decode its header and payload.
- Review claims such as issuer, audience, and expiration.
Formats, limits, and accuracy
Treat access and identity tokens as credentials. Local processing reduces network exposure, but clipboard managers, extensions, or screen sharing may still reveal them.
Frequently asked questions
Does this verify the signature?
No. Verification requires the correct key and algorithm.
Can I edit and reuse the token?
Changing a segment invalidates a correctly verified signature.
Practical notes
Never send production tokens to untrusted websites.
Expiration values are commonly Unix timestamps in seconds.