Does decoding a JWT verify its signature?

No. Decoding only base64url-decodes the header and payload, which are not encrypted and readable by anyone. Verifying the signature requires the signing secret (HMAC) or the public key (RSA/ECDSA) and must be done server-side. A decoded payload is not proof the token is valid.

Why can everyone read my JWT payload?

A standard JWT is signed, not encrypted. The header and payload are only base64url-encoded, so anyone holding the token can read the claims. Never put secrets or sensitive personal data in a JWT payload.

JWT Decoder

Q: Is this JWT decoder safe to use?

Yes. Decoding happens entirely in your browser with JavaScript. The token is never transmitted to any server and no network request is made. Still, avoid pasting long-lived production tokens into any online tool.

Paste a JSON Web Token to inspect its header, payload, and claims. Everything runs in your browser — your token is never sent to a server.

Encoded token

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token used to carry claims between two parties — most commonly for authentication and authorization. It has three parts separated by dots: header.payload.signature. The header and payload are JSON objects that are base64url-encoded, not encrypted. The signature protects them from tampering.

The three parts

Header — the signing algorithm (alg, e.g. HS256, RS256) and token type.
Payload — the claims: registered ones like sub, exp, iat, plus your own.
Signature — an HMAC or asymmetric signature over the header and payload.

Security notes

Anyone with the token can read the payload — never store secrets in it.
Reject alg: none and don't let the token dictate the algorithm — a classic JWT bypass.
Always verify the signature and the exp claim server-side before trusting a token.

Need to analyze tokens at scale, not one at a time? Wildbox's self-hosted JWT analyzer flags alg: none, weak signing algorithms, and expired or long-lived tokens, and plugs into automated API security testing — on your own infrastructure.

Get Wildbox on GitHub

FAQ

Is this JWT decoder safe to use?

Decoding happens entirely in your browser; the token is never transmitted and no network request is made. Even so, avoid pasting long-lived production tokens into any online tool.

Does decoding verify the signature?

No. Decoding only reads the base64url header and payload. Verifying needs the signing secret or public key and must be done server-side — a decoded payload is not proof the token is valid.