JWT Decoder
Inspect a JSON Web Token by revealing its header and payload in readable JSON. See the algorithm, expiry, issuer, and claims without writing a single line of code.
How to use the JWT Decoder
- Paste the full JWT, the three dot-separated Base64URL parts, into the input field.
- The header and payload decode instantly into formatted JSON.
- Check key claims such as exp, iat, iss, and sub.
- Copy any claim value you need for debugging.
When the JWT Decoder is useful
- Debugging authentication failures caused by expired or malformed tokens.
- Verifying which claims an identity provider actually included.
- Inspecting a token before sending it to a third-party service.
- Learning JWT structure by examining real example tokens.
How the JWT Decoder works
Decoding a JWT is a two-step process: split the token on its dots, then Base64URL-decode the first two segments, header and payload. The tool formats both as JSON and highlights common registered claims. Importantly, decoding happens entirely in your browser, so tokens that grant access to internal systems are never pasted into an unknown site that could log and reuse them.
Limits to keep in mind
Decoding is not verification: anyone can edit a payload, so a readable claim proves nothing about authenticity. Signature validation requires the secret or public key.
Frequently asked questions
Does decoding verify the token is genuine?
No. Decoding only reveals the contents; signature verification is a separate cryptographic step.
What does the exp claim mean?
It is the expiration timestamp in Unix seconds; after it passes, conforming systems reject the token.
Is it safe to paste a live token?
The tool never transmits your token, but treat any live credential carefully and use test tokens where possible.
Last reviewed: October 2026.