Tooloo · Security toolkit

JWT Decoder

Read JWT headers, payloads, and expiry locally without verifying signatures.

Local processingNo input storage

Read what is inside a JWT

Paste a three-part JWT to see its header, payload, and expiry. Signatures are not verified here.

Everything is computed in this browser and never sent to a server.

Paste a JWT to see its header, payload, and expiry state.

Decoding is not verification. Readable content does not prove that a token is authentic, unchanged, or usable.

How to use

How does it work?

Paste a three-part JWT to inspect its header, payload, and exp claim.

Privacy

Does decoding mean a JWT is valid?

No. Validity must be fully verified by a trusted server.

Limits and guidance

Security limits

This tool has no issuer public key and does not verify signatures, audience, issuer, or revocation.