Encoding
JWT Decoder
Paste a JWT to inspect its header and payload locally. Decoding is not signature verification, so use it for inspection only.
Decoding does not verify the JWT signature. Avoid pasting sensitive production tokens.
Runs locally in your browser. Your input is not uploaded.
How this tool works
JWTs contain a header, payload, and signature separated by dots.
This decoder reads the first two Base64URL parts locally and displays formatted JSON so you can inspect claims.
Examples
- Inspect an exp claim and convert it with the timestamp tool.
- Check which algorithm is listed in a token header.
- Decode an expired synthetic token and compare exp with the displayed current interpretation.
Common use cases
Decode is not verify
This tool decodes the JWT header and payload so you can inspect readable JSON claims. It does not verify the signature, check issuer or audience rules, validate expiration, or prove that a token came from a trusted identity provider.
Use the output for debugging and inspection. Server-side authentication code still needs proper signature verification and claim validation.
Claims to inspect carefully
- exp and iat values are usually Unix seconds and can be checked with the timestamp converter.
- iss and aud help diagnose issuer or audience mismatches.
- alg tells you what the token header claims, not what your verifier should blindly trust.
- Custom claims may expose tenant IDs, roles, scopes, or user identifiers.
Invalid or unsafe assumption
Invalid/failure example
A two-segment value or malformed Base64URL segment is not JWT compact serialization.
Mistakes to avoid
- Treating decoded claims as trusted.
- Pasting a live bearer token into screenshots or tickets.
- Checking exp but ignoring issuer, audience, key, or algorithm policy.
Limits of this workflow
This tool deliberately does not verify signatures.
Claim times are displayed but no authorization decision is made.
Local-processing and privacy boundary
Tokens are decoded locally and are not persisted; use synthetic tokens because browser, extension, screen, and clipboard risks remain.
Practical workflow
- Use a synthetic or redacted token.
- Inspect header and payload structure.
- Interpret iat, nbf, and exp as untrusted claims.
- Verify signature and policy in the application or a trusted verification library.
Related guides
Official references
FAQ
Does decoding verify the JWT?
No. This tool only decodes Base64URL parts and formats JSON. It does not verify signatures.
Should I paste production tokens?
Avoid pasting sensitive tokens unless you are comfortable inspecting them locally on this device.
Can this page prove a JWT is authentic?
No. Readable claims are not trustworthy until signature and claim policy verification succeeds.