SpeedAbout this page
Inspect JWT header and payload data locally without validating or trusting its signature.
How to use it
- Paste only a test token or a token that has already been safely redacted.
- Decode the header and payload locally in the browser.
- Review issuer, audience, expiry and other claims as untrusted data.
- Validate the signature, algorithm and claims in the receiving application using a trusted library and key source.
How to interpret the result
Readable JWT claims describe what the token asserts; they do not prove the assertion is authentic or authorised.
Privacy and limitations
This decoder does not validate signatures, revocation, issuer keys or application-specific authorisation. Never expose an active bearer token.
Recommended next step
Perform server-side signature and claim validation before trusting or acting on any decoded value.