JWT Decoder
Inspect the readable header and payload portions of a JSON Web Token to troubleshoot claims and token structure. Decoding is local and does not verify the signature or prove that a token is trustworthy.
How to use this tool
- Paste a JWT with its three dot-separated segments into the input field.
- Review the decoded header, payload claims, and signature segment.
- Check issuer, audience, expiry, and other claims against your application's expectations.
Tips
- Never paste a production token into a shared or untrusted computer; decoded claims can contain sensitive data.
- A decoded token is not validated. Verify the signature and claims on your server before accepting it.
Frequently asked questions
Does this JWT decoder verify signatures?
No. It only decodes the token's readable segments. Signature verification must use the issuer's key and your server-side security rules.
What is inside a JWT?
A compact JWT commonly contains a base64url-encoded header, payload, and signature separated by periods.