Does decoding a JWT verify its signature?

No. The page only decodes the three token segments. It does not have the issuer’s key and cannot establish that the claims are authentic.

Can an expired JWT still be decoded?

Yes. Expiry affects whether a system should accept the token, not whether its Base64URL payload can be read. The page marks an expired exp claim when present.

What information can a JWT contain?

The header commonly names the signing algorithm. The payload may contain issuer, subject, audience, issue and expiry times, plus application-specific claims.

JWT Decoder & Inspector

LocalFree

Paste a JSON Web Token to inspect its header, payload, and signature. Tokens are decoded entirely in your browser - nothing leaves your device.

JWT Token

Input

Header

Payload

Signature

Runs in your browser; files and input stay on this device

How to use JWT Decoder & Inspector

1Paste the complete JWT into the token field.
2Inspect the decoded header, payload claims, signature segment, and displayed dates.
3Treat the values as unverified until the token signature is validated by the issuing system.

Frequently asked questions

Does decoding a JWT verify its signature?: No. The page only decodes the three token segments. It does not have the issuer’s key and cannot establish that the claims are authentic.
Can an expired JWT still be decoded?: Yes. Expiry affects whether a system should accept the token, not whether its Base64URL payload can be read. The page marks an expired exp claim when present.
What information can a JWT contain?: The header commonly names the signing algorithm. The payload may contain issuer, subject, audience, issue and expiry times, plus application-specific claims.