Varento Tools
Developer Tools

JWT Decoder

Decode a JWT header and payload locally without sending the token to a server. Free, without signup or usage-count caps.

Free · No signup · No watermark · On-device processing

Use the tool

Decoded claims are unverified. No signature or authorization check is performed.

How to use JWT Decoder

  1. Paste a three-part compact JWT.
  2. Decode the header and payload.
  3. Review the unverified claims; never treat decoding as authentication.

Format behavior and important limits

A compact signed JWT usually has three dot-separated segments. This decoder reads the first two Base64URL segments as UTF-8 JSON and shows the signature segment unchanged. Numeric dates such as exp are also shown in UTC when present.

Decoding is not signature verification. The tool does not establish trust, issuer validity or authorization. Encrypted five-part JWE tokens are not supported.

Example: inspect an expired JWT claim

Use this deliberately unsigned demonstration token to understand the output. It is not a credential and its signature segment is only a placeholder.

Example input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vIiwiZXhwIjowfQ.abc

Expected result

Header: {"alg":"HS256"}
Payload: {"sub":"demo","exp":0}
exp: 1970-01-01T00:00:00.000Z
Signature: UNVERIFIED

Common questions and errors

Why does a readable token still say UNVERIFIED?

Base64url decoding reveals text; it does not establish who issued it. A server must verify the signature, issuer, audience and applicable time claims before accepting a token.

Why will a five-part token not decode?

This tool handles three-part compact JWS tokens. A five-part compact JWE contains encrypted data and needs a different decryption workflow.

Technical references: JWT claims and NumericDate — RFC 7519

Privacy and browser support

Your input is handled in this browser tab. Selected files and entered text are not sent to Varento Tools by this tool. Some specialized libraries load only when needed. A browser with JavaScript and sufficient device memory is required. Read our local-processing explanation.

Related tools

Base64 Encoder / Decoder

Encode Unicode text as Base64 or decode standard and URL-safe Base64.

Open tool →

JSON Validator

Check JSON syntax locally and read an error without changing the input.

Open tool →

Unix Timestamp Converter

Convert Unix seconds or milliseconds to dates and ISO dates back to timestamps.

Open tool →

Frequently asked questions

Is this tool free without daily usage limits?

Yes. Varento Tools has no signup, accounts, usage-count caps, paywalls or watermarks. Device memory, format support and browser restrictions can still limit technically demanding files.

Can a decoded token be trusted?

No. Anyone can construct a payload. A relying application must verify signatures and its issuer, audience and time policies independently.

Is my input uploaded?

No. This utility processes input in the current browser tab. The tool code does not upload your files, tokens or text to a processing API.

What limitations should I know?

Decoding is not signature verification. The tool does not establish trust, issuer validity or authorization. Encrypted five-part JWE tokens are not supported.