JWT Decoder
?About this tool, how to use it, and FAQ▾
What is a JWT decoder?
A JSON Web Token is three Base64URL-encoded segments — header, payload, and signature — joined by dots. This decoder splits a token and shows the header (algorithm and type), the payload claims (subject, issuer, audience, custom claims), the signature, and whether the token has expired based on its exp claim.
Decoding requires no secret because JWT payloads are only encoded, not encrypted — a fact worth remembering before putting sensitive data in one.
How to use
- Paste the full token (the xxxxx.yyyyy.zzzzz string, without any 'Bearer ' prefix).
- Read the decoded header and payload claims.
- Check the expiry status — an expired token is the most common cause of sudden 401 responses.
Frequently asked questions
Does decoding verify the token's signature?
No. Decoding only reads the contents; verifying the signature requires the issuer's secret or public key and happens server-side. A token that decodes cleanly can still be forged or tampered with.
Is it safe to paste a live token into a decoder?
Treat live production tokens like passwords. Prefer expired or development tokens when debugging, and rotate any secret-bearing token you have pasted anywhere.
What are the standard JWT claims?
iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at), and jti (token ID). Times are Unix epoch seconds — the decoder converts exp into a human-readable expiry status for you.