JWT Decoder

Overview

Decode the header and payload of a JSON Web Token (JWT) into readable JSON. Useful for debugging authentication flows and inspecting claims such as exp, sub, and custom fields.

How to use

1. Paste a JWT (three Base64URL parts separated by dots).
2. Click Decode.
3. Inspect the header (algorithm, type) and payload (claims) as formatted JSON.

Examples

• Check token expiry

  Input: An access token from your dev environment

  Output: The exp claim as a Unix timestamp you can compare with the current time.

• Verify claim contents

  Input: An ID token

  Output: sub, aud, iss, and custom claims displayed as JSON.

Notes

• This tool decodes only; it does not verify the signature. Never use it for trust decisions.
• JWTs are Base64URL-encoded, not encrypted. Anyone holding a token can read its payload.
• Avoid pasting production tokens containing sensitive user data into any online tool.

FAQ

Can this tool verify a JWT signature?

No. Verification requires the signing secret or public key. The tool only decodes the Base64URL parts.

Is a JWT encrypted?

A standard signed JWT (JWS) is only encoded, not encrypted. Use JWE if payload confidentiality is required.

Is my token uploaded?

No. Decoding happens entirely in your browser, but prefer non-production tokens as a general precaution.

Embed this tool

Paste this iframe into any HTML page to embed JWT Decoder on your site: