# JWT Decoder

Canonical: https://dev.eneawork.it/jwt
Language: en
Updated: 2026-11-02
Author: Enea Zani (https://eneawork.it)

Read JWT headers, claims and expiry. No signature verification.

## What it does

A JSON Web Token is three Base64URL segments separated by dots. Anyone can read the header and claims; the signature only proves who issued it. This decoder shows the readable parts and flags exp, iat and nbf against your clock. It does not verify signatures — that requires the issuer's key and belongs on a server.

## How to use

1. Paste the token.
2. Inspect the decoded header, payload and time claims.
3. Copy the payload if you need it.

## FAQ

### Does it verify the signature?

No. Verification needs the issuer's public key or secret and must happen server-side. This tool only decodes.

### Is it safe to paste production tokens?

Avoid real secrets. Tokens are displayed in the page and could be visible to browser extensions or someone looking at your screen. Use test tokens.

### Why is my token invalid?

A JWT needs three dot-separated Base64URL segments whose first two decode to JSON. Encrypted JWE tokens are not readable this way.

## Related tools

- [Base64 Encoder](https://dev.eneawork.it/base64)
- [Hash Generator](https://dev.eneawork.it/hash-generator)
- [URL Encoder](https://dev.eneawork.it/url-encoder)

## Machine-readable

- Tool catalogue: https://dev.eneawork.it/tools.json
- Full AI context: https://dev.eneawork.it/llms-full.txt
- Privacy: https://dev.eneawork.it/privacy
- This page in HTML: https://dev.eneawork.it/jwt
- Italian version: https://dev.eneawork.it/it/jwt