JWT Decoder

JWT Decoder splits a JSON Web Token into header, payload, and signature segments—Base64URL-decoding the first two for readable JSON claims.

It does not verify signatures cryptographically unless the workspace explicitly offers local verify with your secret—decode is for inspection, not trust.

OAuth debugging sessions flood support with opaque bearer tokens—decode shows exp and aud without jwt.io uploads.

Developers confirm staging tokens carry the right roles before wiring RBAC middleware.

• Check exp claim on session tokens during auth bugs
• Inspect custom claims in Auth0 or Cognito JWTs
• Compare header alg between legacy HS256 and RS256 services
• Debug microservice JWT propagation in distributed traces
• Teach JWT structure in security workshops

1. 1Paste the full JWT string including three dot-separated parts.
2. 2Read decoded header JSON—note alg and typ fields.
3. 3Read payload JSON—check exp, iat, sub, and custom claims.
4. 4Compare exp timestamp to current UTC time for expiry bugs.
5. 5Clear the input when done—tokens are credentials.

• Decoding proves nothing about authenticity—verify signatures in your app with proper keys.
• Never paste production tokens into untrusted websites—this tool targets local decode only.
• Pair with JSON Formatter on copied payload JSON for nested claim review.
• Clock skew breaks exp checks—allow 30–60 seconds leeway in servers.

• Signature verification requires secrets or public keys—not just decode.
• Encrypted JWE tokens use different structure—this decoder expects signed JWT (JWS).
• Common mistake — trusting decoded claims without verification: attackers forge unsigned alg:none tokens on poorly configured APIs.