Skip to content
littlekit.app
All tools

JWT decoder

Inspect JWT header and payload JSON, timestamps, and signature size with a clear unverified-token status.

Signature not verified

Decoded claims can be forged. This viewer does not authenticate the token, check its issuer, or validate its signature.

Header

The decoded header appears here.

Payload

The decoded payload appears here.
Processed on your device

How it works & useful details

How to use this tool

Paste a three-part JWT to inspect its header, payload, and UTC dates. Use the example to explore the panels.

Details and limits

This decoder does not verify signatures, authenticate users, validate issuers or audiences, or decide whether a token is valid. Claims and declared algorithms can be forged. Do not use this result to make authorization decisions.

Up to 32,000 characters. Header and payload must be JSON objects encoded as UTF-8 Base64url. JWE encrypted five-part tokens are not supported. The token remains only in page memory.