Decodificare un JWT equivale a verificarlo?

No, la decodifica mostra il contenuto di header e payload (codificati in Base64, non cifrati), ma non verifica che la firma sia autentica. Per verificare la firma serve la chiave segreta o pubblica usata dal server che ha emesso il token.

Il token JWT che incollo viene inviato a un server?

No, la decodifica avviene interamente nel browser: il token non lascia mai il tuo dispositivo, il che lo rende sicuro da usare anche con token di produzione durante il debug.

Come faccio a sapere se un token è scaduto?

Lo strumento mostra il claim "exp" (expiration) del payload, indicando la data e ora di scadenza del token, così puoi verificare rapidamente se è ancora valido.

Free Online JWT Decoder — Decode and Inspect JWT Tokens

When to use a JWT token decoder

This tool decodes and inspects a JWT token, showing header, payload, and expiration — useful for debugging authentication (e.g. Firebase Auth) or APIs that use JWT.

When to use it

You need to check the content of a JWT token while debugging an authentication flow.
You want to check a token's expiration date (the exp claim) without decoding it by hand.
You need to inspect custom claims in a JWT payload generated by your application or a service like Firebase Auth.

When NOT to use it

You need to verify the token's cryptographic signature to make sure it hasn't been tampered with: this tool decodes the content (Base64), but doesn't verify the signature, which requires the issuing server's secret or public key.

Alternatives

Server-side JWT libraries (jsonwebtoken, jose) to verify the signature with the correct key, not just decode the content.
Debug tools built into your auth provider (e.g. the Firebase Auth console) for an end-to-end check.

Common mistakes

Confusing "decoding" with "verifying": anyone can decode a JWT without a key, because the header and payload are just Base64-encoded, not encrypted. Verifying the signature requires the secret key.
Pasting production JWT tokens with sensitive data into online tools that send them to a server: this tool works entirely locally, but it's good practice to always check that before pasting a token elsewhere.
Not checking the "exp" claim and assuming a token is always valid: JWTs typically have a short expiration.

Frequently asked questions about JWT token decoding

No, decoding shows the content of the header and payload (Base64-encoded, not encrypted), but doesn't verify that the signature is authentic. Verifying the signature requires the secret or public key used by the server that issued the token.

No, decoding happens entirely in your browser: the token never leaves your device, which makes it safe to use even with production tokens while debugging.

The tool shows the "exp" (expiration) claim from the payload, giving you the token's expiration date and time, so you can quickly check whether it's still valid.

🔑 JWT Decoder

What is a JWT?