Zum Inhalt springen
JWT

JWT Decoder

Inspect the payload of a JSON Web Token.

Läuft im Browser — Daten verlassen Ihr Gerät nicht

…alg: HS256typ: JWT
{ "alg": "HS256", "typ": "JWT" }
{ "sub": "1234567890", "name": "toco.tools", "admin": false, "iat": 1700000000, "exp": 1900000000 }
iat
2023-11-14T22:13:20Z / 11/15/2023, 7:13:20 AM
exp
2030-03-17T17:46:40Z / 3/18/2030, 2:46:40 AM
Signature

b6eofQ9HFFK2agA2PMVr_YFNJwB0WkVVtGyrvRfzpaw

Decode mode does not verify signatures. Use the Verify tab for HS256 validation.

Über JWT Decoder

A JSON Web Token (JWT) packs header, payload, and signature as Base64URL segments—common in OAuth and API auth for carrying claims. toco.tools decodes the header and payload JSON locally so you can inspect exp, sub, and custom claims quickly. Signature verification is not performed here. Always validate tokens on your server for authorization decisions. Tokens may contain sensitive claims.

So funktioniert's

  1. Paste the JWT string
  2. Review header and payload
  3. Copy claims you need

FAQ

What is a JWT decoder?

A tool that splits a JWT and shows the header and payload JSON.

Is the token sent externally?

No. Decoding runs entirely in your browser.

Does it verify the signature?

No. It only displays decoded parts; cryptographic verification is not done.