What does the JWT decoder show?

It decodes the header and payload so you can read the claims inside a JSON Web Token.

Is my token sent to a server?

No. Decoding happens in your browser, so sensitive tokens stay on your device.

It decodes and displays the contents; it does not validate the signature, which needs the secret key.

Yes, timestamp claims like exp and iat are shown so you can check validity.

No. A standard JWT payload is only Base64-encoded, so never put secrets in it.

A JWT is header.payload.signature, each Base64url-encoded and separated by dots.

عرض رأس JWT والحمولة كـ JSON (دون التحقق من التوقيع).

JWT

Header

Payload

فك JSON Web Token لفحص الرأس والحمولة دون إرساله لأي موقع. الطريقة الآمنة لمعرفة claims التي يحملها الرمز.

كيفية الاستخدام

الأسئلة الشائعة

What does the JWT decoder show?: It decodes the header and payload so you can read the claims inside a JSON Web Token.
Is my token sent to a server?: No. Decoding happens in your browser, so sensitive tokens stay on your device.
Does it verify the signature?: It decodes and displays the contents; it does not validate the signature, which needs the secret key.
Can I see when a token expires?: Yes, timestamp claims like exp and iat are shown so you can check validity.
Is the payload encrypted?: No. A standard JWT payload is only Base64-encoded, so never put secrets in it.
Why are there three parts?: A JWT is header.payload.signature, each Base64url-encoded and separated by dots.