JWT Decoder guide
Inspect the JSON header and payload of a three-part JSON Web Token locally, without confusing decoding with security verification.
What this tool does
The JWT Decoder separates a compact token into its header, payload, and signature sections. It converts the Base64URL-encoded header and payload back to UTF-8 and formats both as readable JSON. When numeric iat or exp claims are present, the tool also displays their UTC timestamps.
A readable payload is not proof that the token is genuine. JWT header and payload data are encoded, not encrypted, and anyone can create or change them. A trusted server must verify the cryptographic signature with the correct key and must enforce an allowed algorithm, issuer, audience, expiration, not-before time, and application-specific authorization rules.
The decoder intentionally does not accept a verification key and never labels a signature as valid. Its purpose is limited to debugging token structure and inspecting claims that are already safe to view on the current device.
How to use it
- Copy a three-section JWT that you are authorized to inspect.
- Remove an optional
Bearerprefix before pasting it. - Select Decode JWT.
- Inspect the formatted header and payload.
- Treat the claims as untrusted until the issuing system verifies the token.
Do not paste production access tokens into shared computers, screenshots, support tickets, or public chat. A token can grant access even when its payload looks harmless. This page processes input locally, but other browser extensions, device software, clipboard history, or people with access to the screen may still expose sensitive credentials.
Benefits
- Decodes standard Base64URL JSON sections
- Formats header and payload for readable inspection
- Converts numeric issued-at and expiration claims to UTC
- Keeps the pasted token inside the current browser session
- Displays a persistent warning that decoding is not verification
Understanding common claims
The sub claim usually identifies the token subject. iss identifies the issuer, aud identifies the intended audience, iat records an issued-at time, nbf can restrict use before a time, and exp records expiration. Their meaning and required values depend on the issuing system.
Even an unexpired token can be invalid because its signature, issuer, audience, algorithm, or permissions are wrong. Conversely, a decoder clock warning is only a convenience; the server’s verified rules determine whether a token is accepted.
Security notice: Never use decoded claims alone to authenticate a user or authorize access. Verification must happen in a trusted server environment with an approved library and key configuration.