Does this JWT decoder store my token?
No. Decoding runs in your browser. QASignoff does not send the token to a server or keep it after you close the tab.
Free tool · JWT Decoder
JWT Decoder — Decode JSON Web Tokens OnlineInspect header, payload, and expiry in your browser.
We don’t store anything. This session only—close the tab and it’s gone.
PrivateFormat a payload? JSON Formatter · JSON Diff · Compare · Env Diff
This tool does not check the signature. Anyone can read the payload.
0 chars
Paste a JWT to inspect claims. Tokens stay in this browser.
Decode JWT tokens in your browser
Use this JWT decoder to inspect Bearer tokens from API responses, failed logins, and test fixtures without leaving the page. It is meant for quick QA checks: what is in the payload, when it expires, and whether the token is even a JWT.
What is a JWT?
A JSON Web Token is three Base64URL parts separated by dots: a header (algorithm and type), a payload (claims such as subject and expiry), and a signature. Decoding reads the first two parts. Verifying the signature is a separate step this tool does not perform.
Decode vs verify
Decoding shows you the claims. Verification proves a trusted key produced the signature. Treat decoded payloads as public once someone has the token. Use this page to inspect—not to prove authenticity.
How to decode a JWT online
- 1Paste a compact JWT, or an Authorization value that starts with Bearer.
- 2Review header, payload, and expiry status. Decoding happens as you type.
- 3Copy claims you need for a QA note—or continue the check in Signoff Studio.
Why use this JWT decoder
- Decode tokens in the browser with nothing stored on QASignoff servers.
- See expiry as a quality signal: active, expired, not yet valid, or missing exp.
- Paste from Authorization headers without stripping Bearer yourself.
- Inspect registered claims (iss, sub, aud, jti, iat, nbf, exp) next to the raw JSON.
- Use it free, with no account.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the header and payload. Anyone with the token can read those parts. Signature verification is out of scope for this decoder.
What does Expired mean?
The exp claim is a Unix timestamp. If it is in the past, the token is past its stated lifetime. That is a quality signal for QA—it does not prove whether a server would still accept the token.
Can I decode an encrypted JWT (JWE)?
No. Encrypted tokens have five parts. This tool only inspects compact JWS tokens with three parts: header, payload, and signature.
Is it safe to paste a production token?
The payload is readable by anyone who has the token. Prefer local or test tokens. Close the tab when you are done. We do not store what you paste, but your screen, clipboard, and browser extensions still can.
How is this different from jwt.io?
This decoder is built for QA checks: expiry in plain language, Bearer paste, and a privacy-first browser session. It is not a JWT protocol tutorial and it does not verify signatures.
Can I paste an Authorization header?
Yes. A leading Bearer prefix is stripped automatically so you can paste the header value as-is.
Do I need an account?
No. The JWT decoder is free, runs in the browser, and does not require signup or installation.
Signoff Studio
Decode the token here. Use it in one workspace.
Collections, auth, and sign-off in Signoff Studio.