JWT Decoder

The JWT Decoder splits a JSON Web Token into its header, payload, and signature and shows the decoded claims. It is for developers inspecting authentication tokens while building or debugging an API, where the signature is never transmitted.

A JWT is opaque Base64url until decoded, and pasting one into a random site risks leaking a live credential. Decoding it locally lets you read the claims with the token staying entirely in your browser.

1. Paste a JWT into the input field.
2. The token is split at its dots into header, payload, and signature.
3. The header and payload are Base64url-decoded and shown as readable JSON.
4. Inspect the claims, such as issuer, subject, and expiry.
5. Copy any part you need for your debugging.

• Header, payload, and signature separation
• Base64url decoding to readable JSON
• Claim inspection
• Signature never sent anywhere

• Checking the claims and expiry of an auth token while debugging
• Confirming an identity provider issued the expected scopes
• Inspecting a token returned by an OAuth flow
• Teaching how JWTs are structured

• Decoding does not verify the signature — never trust a token’s claims without validating it server-side.
• Treat any token you paste as a live secret; avoid sharing screenshots that include it.
• The expiry claim is a Unix timestamp; an expired token is invalid even if it decodes cleanly.