Does this verify the signature?

No. Signature verification requires the shared secret (HS*) or public key (RS*/ES*), which should never be pasted into a public web tool.

Is pasting a production token safe?

Decoding runs entirely in your browser — nothing is uploaded. Even so, avoid pasting long-lived or highly privileged tokens; rotate if in doubt.

A JWT header claiming no signature. Any library that accepts alg:none is critically vulnerable — always reject it server-side.

Testers

Paste a JSON Web Token to decode its header, payload, and signature. Everything runs in your browser — your token is never sent to a server.

Signature is not verified — this tool only decodes the token. Do not use this to validate trust.

JWT Token

Paste a JWT above to decode it