JWT Signature Not Verified – Decode vs Verify Explained

Local only

Decode readable JWT claims without confusing local inspection with signature verification or authorization.

68 chars · 1 line

95 chars · 9 lines

Algorithm: HS256Signature not verifiedTime status: Not evaluated (no numeric exp/nbf)

JWT security warning

Why decoding a JWT does not verify its signature

JWT header and payload segments are encoded, not encrypted. Anyone can construct readable claim data. This decoder deliberately reports Signature not verified so decoded values are never presented as authenticated facts. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Decode the token to inspect header and payload only.
  2. Treat every decoded claim as untrusted input.
  3. Verify the signature with the expected algorithm and trusted key, then validate issuer, audience, expiry, and application-specific requirements in your security boundary.

Readable claims are not proof of authenticity

Base64URL decoding is reversible and requires no secret. Signature verification is a separate cryptographic operation, so this browser decoder intentionally performs no trust decision on the third segment.

Decoded but unverified JWT example

A normal-looking token still carries an explicit verification warning.

Decoder result

{"sub":"123"}

Security status

Signature not verified

Common questions

Frequently asked questions

Does the decoder check the JWT signature?

No. It never claims that decoded header or payload data is authentic.

Why not verify with the alg field automatically?

Verification requires a trusted key and an expected algorithm policy. Trusting algorithm information supplied by the unverified token itself would be unsafe.

Can I use decoded claims for authorization?

Not until a trusted verifier has validated the signature and all required claims for your application.

Recommended next steps

JWT Expired TokenDecode an exp claim and understand the decoder's Expired status.JWT Invalid JSON HeaderFix a Base64URL header whose decoded text is not a JSON object.JWT Decoder OnlineDecode JWT header and payload data locally in the browser.

Debugging a specific JWT issue? Browse JWT troubleshooting.