JWT Decoder
Processing: API. Processed by cent-ai's API: sent to our server, held in memory, never stored.Paste a JWT to decode its header and payload. This tool never verifies the signature — decoding a token proves nothing about whether it's authentic. Nothing you paste here is stored or logged.
How to use it
- Paste a JWT (header.payload.signature) into the input field.
- Select “Decode” to see the decoded header, payload, and any time-based claims.
- Copy the result to your clipboard, or download it as a text file.
Example
Select “Use example” above to load a sample token.
Privacy and security
- Input is sent to our API only to be decoded; it is never persisted or logged.
- Requests are not included in analytics or error reporting.
- The signature is never checked — this tool only decodes, it never verifies trust.
- Request bodies are limited in size to keep the service responsive for everyone.
Limitations
- Signature verification is never performed — use a library with your signing key if you need to confirm authenticity.
- Only the standard three-segment compact JWT format is supported.
- Very large payloads may be rejected to protect the service.
FAQ
Does this verify the token's signature?
No. This tool only decodes the header and payload — it never checks the signature, so it cannot confirm a token is authentic or was issued by a trusted party. Never treat a decoded token as verified.
Is my token stored anywhere?
No. Input is processed in memory to produce the decoded output and is not saved or logged.
Why was my input rejected?
A JWT must have exactly three dot-separated segments (header.payload.signature), and the header and payload segments must each be valid base64url-encoded JSON objects.