Is it safe to paste a production JWT here?

Yes. Everything runs in your browser with zero network calls — no server ever sees your token. That said, JWT payloads often contain PII (user IDs, emails, session data), so decoding and sharing screenshots is still a data-leak risk. Treat a JWT like a password.

Why doesn't this tool verify the signature?

Signature verification requires your signing key (HS256 secret or RS256 public key). Uploading keys to a web tool is a security anti-pattern. Use a server-side library like jsonwebtoken (Node), PyJWT (Python), or jose for verification. This tool only decodes the payload.

What does the 'exp' claim mean?

'exp' is the expiration timestamp (Unix seconds). If the current time is past 'exp', the token is expired and servers will reject it. The tool shows the local expiry time and flags expired tokens in red.

Why is my JWT showing as invalid?

A valid JWT has exactly three base64url-encoded segments separated by dots: header.payload.signature. Copy errors (missing characters, trailing whitespace, truncation) are the usual culprits. Decode errors on the header or payload usually mean the segment isn't valid base64url.

JWT Decoder

Paste a JWT (JSON Web Token) and instantly see the decoded header, payload, and signature. The tool shows the expiration time, flags expired tokens, and highlights iat/nbf claims. Runs entirely in your browser — no network call, so it's safe to paste production tokens. Signature verification is intentionally out of scope (decode only).

JWT Token0 / 100,000

Frequently Asked Questions

Is it safe to paste a production JWT here?: Yes. Everything runs in your browser with zero network calls — no server ever sees your token. That said, JWT payloads often contain PII (user IDs, emails, session data), so decoding and sharing screenshots is still a data-leak risk. Treat a JWT like a password.
Why doesn't this tool verify the signature?: Signature verification requires your signing key (HS256 secret or RS256 public key). Uploading keys to a web tool is a security anti-pattern. Use a server-side library like jsonwebtoken (Node), PyJWT (Python), or jose for verification. This tool only decodes the payload.
What does the 'exp' claim mean?: 'exp' is the expiration timestamp (Unix seconds). If the current time is past 'exp', the token is expired and servers will reject it. The tool shows the local expiry time and flags expired tokens in red.
Why is my JWT showing as invalid?: A valid JWT has exactly three base64url-encoded segments separated by dots: header.payload.signature. Copy errors (missing characters, trailing whitespace, truncation) are the usual culprits. Decode errors on the header or payload usually mean the segment isn't valid base64url.

Related Tools

Markdown Cheat Sheet

Interactive Markdown cheat sheet with live examples. Free Markdown syntax reference guide.

Regex Find & Replace

Find and replace text in Markdown using regex. Free online regex find and replace with live preview.

YAML Frontmatter Editor

Visual editor for YAML/TOML frontmatter. Free online frontmatter builder for Jekyll, Hugo, and Astro.

Transcript Cleaner

Clean up auto-generated transcripts, SRT subtitles, and raw captions. Remove timestamps, filler words, and speaker labels. Free online transcript cleaner.

About JWT Decoder

Decode any JWT token. See header, payload, expiry, and signature in a clean layout. 100% client-side — your token never leaves your browser. This tool runs entirely in your browser, so your content is not sent to a server. MarkdownMe provides free, fast, and reliable Markdown tools for developers, writers, and anyone who works with Markdown.