FileGizmo — Developer tools
Decode a JWT token
Decode JWT header and payload claims locally with explicit signature-verification warnings.
Simple by design
JWT decoder in three steps
Inspect the header and payload of a JSON Web Token without sending credentials to an online service. FileGizmo decodes the token’s Base64url sections into readable JSON, preserves the signature text, and highlights when a numeric expiration claim is earlier than the current device time.
Decoding is not verification. Anyone can construct or modify an unsigned token payload, so decoded claims must never be trusted by themselves. Production systems need server-side signature verification with an approved algorithm and key, plus issuer, audience, expiration, not-before, and application-specific checks. The interface keeps this warning next to every result.
The token stays in the current browser page and is not uploaded or stored. Use the decoder for local debugging and claim inspection, then remove sensitive tokens from shared screenshots, issue trackers, and messages. If a real credential has been exposed, revoke or rotate it according to your authentication system’s incident procedure.
- 1
Paste a three-part JWT token
- 2
Decode its header payload and signature text
- 3
Review claims and expiration warning carefully
Good to know
Frequently asked questions
Does decoding verify the signature?
No. Only your server with the correct key and algorithm can establish token authenticity.
Is the token uploaded?
No. Base64url decoding happens entirely in your browser.
Does FileGizmo detect expiration?
It compares a numeric exp claim with the current device time and labels expired tokens.
Is it safe to trust decoded claims?
Never trust claims until the token signature, issuer, audience, and timing have been verified server-side.
Learn more