What this tool does
JWT Decoder splits a JSON Web Token into header, payload, and signature sections so claims can be inspected in readable JSON.
← All Tools
🎫 JWT Decoder
Decode JWT header, payload, and signature locally, with expiry hints and explicit signature-verification caveats.
Sensitive token warning
- JWTs can contain emails, account IDs, scopes, expiry times, and private claims.
- Do not paste production access tokens, refresh tokens, session cookies, or bearer tokens. Decoding is not validation or revocation.
JWT decode checks
Validates the 3-part compact structure, parses header/payload JSON, extracts exp/iat timestamps, and repeats that decoded claims are untrusted until signature and claims are verified by a backend.
Why it is useful
It helps debug authentication flows, token expiry, issuer/audience claims, scopes, and integration problems without manually base64url-decoding each segment.
How it works
The page decodes the header and payload in the browser. Decoding is not the same as verifying the token signature.
Best input
Use development or non-sensitive tokens when possible. Check exp, iat, iss, aud, sub, and scope claims carefully.
Privacy note
Decoding happens locally in your browser.
Important limitation
Do not paste production bearer tokens or secrets into websites. This tool does not prove a JWT is valid unless signature verification is explicitly implemented.
Quick answers
Is decoding a JWT safe?
Decoding only reads the token content. The risky part is exposing a live token that could grant access elsewhere.
Does this verify the signature?
No. Treat decoded claims as untrusted unless your backend verifies the signature and expected claims.
Common Use Cases
Debug authentication issues
Inspect claims, expiration, and scopes during development.
Verify token structure from third parties
Inspect JWTs issued by identity providers before wiring validation logic.
Check token expiration during testing
Quickly see exp and iat timestamps without custom code.