Decoding does not verify the signature or prove the token is authentic. Do not paste production credentials into tools you do not trust.
How to use this jwt decoder
- Paste the JWT.
- Select Decode token.
- Inspect the formatted header and payload.
What does a JWT decoder show?
A JWT decoder separates a token’s three dot-separated parts and converts its Base64URL header and payload into readable JSON. The header usually identifies the signing algorithm, while the payload carries claims such as a subject, audience and expiry time. The third part is the signature, which this read-only tool deliberately does not validate.
What do common JWT claims mean?
Common registered claims include iss for the issuing authority, sub for the subject, aud for the intended audience, and exp for the expiry time. A decoded claim is only visible data, not proof that an application should trust it. Your server must still verify the token’s signature, issuer, audience and time-based claims.
Can decoding a JWT verify it?
No. Decoding only reads the header and payload; anybody can change either section and encode it again. Signature verification needs the correct secret or public key and an expected algorithm. Use this tool to inspect a token format while troubleshooting, but never treat its decoded contents as authenticated identity or permission data.