Decode JWT tokens to view headers and payload. No verification — just view the contents.
Auth · JWT · debug claims
Inspect JSON Web Tokens without leaving your browser. Paste a JWT to decode the header and payload, read claims like sub, exp, and aud, and debug auth issues — without sending the token to a remote server.
A JSON Web Token is three Base64url segments separated by dots: header.payload.signature. The header typically names the algorithm (alg) and token type. The payload carries claims — registered ones like iss, sub, aud, exp, nbf, iat, plus app-specific fields (roles, tenant id, email).
Decoding only reverses Base64url encoding so you can read those JSON objects. It is not authentication. Anyone who has the token string can decode it. Trust requires verifying the signature with the correct secret or public key (often via JWKS), then enforcing exp/nbf, audience, and issuer in your API.
Security: This tool does not verify signatures. A decoded token can be forged or expired. Never treat “it decoded” as “it is valid.” Avoid pasting long-lived production refresh tokens on shared machines.
Authorization: Bearer … header, or log line.exp/iat values with the Timestamp Converter if you need a human date.| Claim | Meaning | What to check in production |
|---|---|---|
sub | Subject (user/service id) | Maps to the right principal in your app |
exp | Expiration (Unix seconds) | Reject if now ≥ exp (clock skew policy) |
nbf | Not before | Reject if now < nbf |
aud | Audience | Must match this API / client id |
iss | Issuer | Must match your IdP |
kid (header) | Key id | Selects the correct JWKS key |
exp is in the future and aud/iss match what the API expects.alg of none or unexpected algorithms should fail closed in verifiers.eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cSegment 1 decodes to a header like {"alg":"HS256","typ":"JWT"}. Segment 2 is the payload claims. Segment 3 is the signature (not verified here).
No. Verification needs your HMAC secret or asymmetric public key and belongs in your auth library. This page only decodes for inspection.
Decoding runs in your browser. We do not intentionally log token contents. Prefer local tools for production secrets. Privacy Policy.
Usually a truncated token, wrong paste (missing a segment), or non-JWT Base64. Confirm exactly three dot-separated parts.
JWTs are self-contained and readable (when decoded). Opaque tokens are random ids looked up server-side. Both can be secure when implemented correctly; don’t put secrets you can’t afford to leak into JWT payloads.