JWT Decoder

The JWT Decoder splits a JSON Web Token into its segments and decodes the base64url-encoded header and payload into readable, pretty-printed JSON. This lets you inspect the claims carried inside a token, such as the subject, issuer, audience, scopes and expiry, without writing any code or pasting your token into an unfamiliar server-side service that you may not trust.

This tool is aimed at developers, QA engineers and support staff who work with token-based authentication every day. When a login fails, an API returns an unexpected error, or you simply need to confirm what a token contains, decoding it here gives an immediate, human-readable view of the header algorithm and every claim in the payload, turning an opaque string into something you can reason about.

Crucially, the decoder reads a token but does not verify its signature, and everything runs locally in your browser. Decoding reveals the contents but does not prove authenticity, which requires the signing key on a server. Standard time claims are shown as readable dates so you can tell at a glance whether a token has expired, all without the token ever leaving your device.

Features

• Splits the token on its dots and decodes the base64url header and payload into cleanly indented, readable JSON.
• Displays the signing algorithm taken from the header so you can confirm how the token was meant to be signed.
• Interprets the iat, exp and nbf time claims as Unix timestamps and shows them as readable UTC dates in the stats.
• Gives clear, specific error messages when a token is malformed, missing a segment or not valid base64url JSON.
• Presents the decoded header and payload in a monospace font that is easy to read, scan and copy into notes.
• Reminds you in the output that the signature is not verified, preventing the mistake of trusting decoded contents.
• Accepts both two-segment and three-segment tokens, decoding the header and payload from whichever you provide.
• Runs entirely in your browser with no uploads or accounts, so the token you paste is never sent to any server.

How to use JWT Decoder

1. Paste your JSON Web Token, in the header dot payload dot signature form, into the input box or load it from a file.
2. Let the decoder split the token and read the decoded header and payload as pretty JSON in the output area.
3. Check the signing algorithm shown in the stats to confirm how the token claims to have been signed.
4. Review the issued-at, expiry and not-before dates in the stats to determine whether the token is still valid.
5. If a malformed token error appears, verify each segment is present and is valid base64url-encoded JSON.
6. Copy the decoded JSON if you need to record the claims in a ticket, share them with a colleague or compare tokens.

Benefits

• Developers debug authentication flows by inspecting exactly which claims, scopes and roles a token actually carries.
• Engineers confirm a token expiry while troubleshooting, quickly distinguishing an expired token from other failures.
• QA teams verify that issued tokens contain the correct audience, subject and permissions during testing.
• Support staff decode a token a user provides to understand an access problem without needing backend logs.
• Anyone can read a token contents privately and safely, since decoding never sends the value to a server.
• Integrators inspect third-party tokens to learn their structure before writing code that consumes them.

A typical use is diagnosing a 401 or 403 response from an API. You paste the token your client is sending, read the payload, and discover whether the expiry has passed, the audience is wrong, or an expected scope is missing. This turns a vague authorization failure into a concrete, fixable observation in seconds, without adding logging or redeploying anything.

Because the signature is deliberately not verified, never trust a decoded token for authorization decisions on its own. Decoding is purely for inspection and debugging; genuine verification must happen on a server using the secret or public key. Anyone can read or even craft a payload, so the contents shown here prove what a token says, not that it is authentic.

All decoding happens locally in your browser, so the token you paste is never transmitted, logged or stored anywhere. The tool handles standard base64url-encoded JWTs and reports a clear error when a segment is missing or cannot be decoded. It does not decrypt encrypted JWTs or validate signatures, so treat it as a reader for inspecting claims rather than a security check.