JWT Decoder
Decode and inspect JWT tokens
Use JWT Decoder
Warning: No Verification
This tool only decodes JWTs. It does NOT verify signatures. Never trust decoded JWT data without proper verification.
Output details
Copy-ready workflow handoff
Decode a JWT locally and copy claim details for auth debugging.
Decoded claims are not verified signatures; server-side verification still matters.
JWT payloads often expose accounts, scopes, emails, tenants, and expiry windows.
Copy this after replacing the bracketed output with the live result from the tool.
JWT claim handoff: [paste the current tool output here]. Workflow: Decode a JWT locally and copy claim details for auth debugging. Sample to test: Paste a compact three-part token from an Authorization header or auth trace. Output to review: Copy header and payload claims such as alg, kid, iss, aud, sub, exp, and nbf. Invalid/error check: Decoded claims are not verified signatures; server-side verification still matters. Privacy note: JWT payloads often expose accounts, scopes, emails, tenants, and expiry windows. Next check: Use HTTP Header Parser to confirm the bearer token was sent in the expected header.
Assumptions
Use this page when you need readable JWT claims before you debug bearer token failures, issuer mismatches, or expiry issues.
Worked example
When To Use This JWT Decoder
- Open a staging or production token to inspect exp, nbf, aud, iss, and role fields without writing local code.
- Confirm whether the token payload is wrong before you investigate middleware, cookies, or session storage.
Check These Token Details First
- Make sure the token still has three Base64Url segments before trusting the decoded output.
- Treat the decoded payload as readable data only; this page does not verify the signature.
- Compare issuer, audience, and timestamp values against the environment you expect.
About This Tool
A JWT decoder makes the token header and payload readable so you can inspect algorithm metadata, key IDs, issuer, audience, subject, scopes, roles, and time-based claims while debugging authentication or authorization failures.
Decoded Does Not Mean Verified
This page decodes Base64Url sections; it does not verify the signature or prove that the token should be trusted. Server-side verification must still check the issuer, audience, expiry, signing key, algorithm, and application authorization rules.
Authentication Debugging Checks
When a request returns 401 or 403, compare iss,aud, sub, exp, andnbf against the environment that issued the token. Convert epoch claims with the Timestamp Converter and format nested claim objects with the JSON Formatter.
Privacy Note
Decoding runs in the browser, but JWT payloads often expose user IDs, tenant IDs, emails, scopes, and environment names. Use staging tokens or redact claims before sharing screenshots or copied output.