Skip to content
PiPi Worlds
Menu & settingsClose
JWT Decoder
Inspect sample JWT claims and expiry. No signature verification.
Blog

Copies this page address only, without URL inputs, tracking parameters or a section anchor. It does not share calculation results.

JWT decoder, see inside.

Use sample or test tokens, not live credentials. An expiry check does not verify a signature or permissions.

Input

Getting ready. Input becomes available when the tool is ready. If this message stays, reload or check that JavaScript is enabled. Signatures are not verified. Paste sample or test tokens only; do not paste live access tokens.

Output
Output appears here.

Read the structure of a signed JWT

This tool accepts the common three-part signed JWT format: header, payload, and signature. It decodes the first two into readable JSON and shows the signature as-is. Time claims like exp, iat, and nbf are converted from Unix epoch to ISO timestamps. The badge only compares exp with the current time; it cannot prove that a token is valid.

Decode is not verify

Anyone holding a common signed JWT can read its encoded header and payload; encrypted JWTs are different. Authenticity requires checking the signature with a trusted secret or public key, which this tool never asks for and never has. Treat the decoded contents as untrusted until your server verifies the signature.

Do not paste a live credential

This tool's decode operation runs in your browser, but that does not make a website a safe place for a live bearer token. Anyone who obtains such a token may be able to use it. Use the built-in sample or a test token; follow your organization's approved local debugging process for production credentials.

FAQ

Does this check if the token is valid?
No. It decodes and shows expiry from the exp claim, but it does not verify the cryptographic signature — that needs the secret/key on your backend.
Should I paste a real access token here?
No. Use a sample or test token. Browser-side decoding does not guarantee the safety of a live credential. If you exposed one, follow your issuer's revocation or rotation procedure.