JWT Decoder
Read the visible header and payload fields of a JWT for debugging, without treating decoding as validation.
Popular in this group
Switch tools without re-entering your text.
Loading tool…
About this tool
JWT Decoder — A JWT commonly contains Base64URL-encoded header and payload sections plus a signature. Decoding reveals claims such as issuer, subject, audience, and expiry.
A readable payload does not prove authenticity. Signature verification requires the expected algorithm, key, issuer, audience, and validation rules in trusted application code.
How to use it
- Paste a non-sensitive JWT.
- Decode the token to inspect header and payload.
- Validate the signature and claims separately in your application or trusted library.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.signature
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"123"}The example signature is not verified and should not be trusted.
Common uses
- Inspect claims during integration testing.
- Check whether timestamps and audiences look expected.
- Understand token structure while debugging.
What to know
- Never paste active production tokens into shared or untrusted devices.
- Decoding cannot detect a forged or expired token by itself.
Privacy: The operation runs locally in your browser; your input is not uploaded by this tool.
Frequently Asked Questions
Does decoding verify the signature?+
No. Decoding only reads the visible sections and does not establish authenticity.
Can a JWT contain secrets?+
JWT payloads are often readable, so confidential data should not be placed in them merely because the token is signed.
What does exp mean?+
It is commonly the expiration time represented as a NumericDate, but your application still needs to validate it correctly.