JWT Decoder

The JWT Decoder splits a JSON Web Token into its header and payload and shows the claims as readable JSON. A JWT is made of three base64url parts: the header (algorithm and type), the payload (the claims, including exp, iat, sub, and custom fields), and the signature. Decoding lets you see exactly what a token asserts without needing the signing key. This is invaluable when debugging authentication, checking whether a token has expired, or understanding what an API provider returned. Keep in mind that decoding is not verification: it does not prove the signature is valid, so treat the claims as informational only and verify signatures on the server. A JSON Web Token is three base64url segments joined by dots, and decoding it is a matter of splitting the string and reading each part as JSON. The header names the signing algorithm and the token type; the payload carries the claims, including the registered ones such as issuer, subject, audience, expiration, and issued at, plus whatever custom fields the issuer decided to add; the signature is what a server uses to prove the first two parts were not altered. Seeing the claims in readable form is the fastest way to answer practical questions: has this token already expired, which user or service does it represent, and does it carry the scope I expected. It is equally useful when you are wiring up an integration and need to confirm the provider is sending the fields the documentation promised. The essential caveat is that decoding is not verification. Reading the payload proves nothing about authenticity, because anyone can craft a token with any claims; signature checking happens on the server with the secret or public key, and that step is what actually makes a token trustworthy.

📘 Related guide: Decode and verify a JWT locally (no server, no leaking →