Practical guide
Decode JWT Locally Without Uploading Tokens
JWTs are easy to decode because the header and payload are Base64URL encoded. That is useful for debugging, but it is also why production tokens should be handled carefully. Local decoding helps you inspect structure without sending the token to a server.
Open the free toolStep-by-step
- Copy the JWT from your development environment, not from a production user session unless you are allowed to inspect it.
- Paste the token into the JWT decoder.
- Check the algorithm, type, issuer, audience, subject, expiration, and not-before claims.
- Use the timestamp converter if you need to confirm exp or nbf in local time.
- Remember that decoding does not validate the signature.
- Verify the signature and claims in your application before trusting the token.
Important tips
- A decoded JWT is readable, not verified.
- Avoid sharing screenshots that contain real tokens.
- Be careful with alg values and make sure your backend enforces expected algorithms.
- If the token is encrypted as JWE, use the JWE parser to inspect its protected header instead of the JWT decoder.
Frequently asked questions
Does local JWT decoding make the token valid?
No. It only reads the header and payload. Trust requires signature verification and claim validation.
Can anyone decode a JWT?
Usually yes. JWT payloads are encoded, not encrypted, unless you are using JWE.
Should I paste production JWTs into tools?
Avoid it unless the tool is trusted, local, and you are authorized to inspect the token.