JWT Decoder
Decode JSON Web Tokens to inspect Header, Payload claims, and expiration.
⚠️ Security Disclaimer: Decoding a JWT reveals its payload contents but DOES NOT verify its signature. Anyone can issue a forged JWT with arbitrary payload. Never trust unverified JWT claims for security decisions.
JOSE Header
Payload Claims
What JWT Decoder Does
Decode JWT tokens locally in your browser. Inspect JOSE header parameters, payload claims, and token expiration state.
How It Works
- 1.Paste a JSON Web Token (encoded as header.payload.signature) into the editor.
- 2.The tool decodes Base64URL header and payload parts locally in your browser.
- 3.Inspect claim fields (subject, issuer, issued at, expiration time).
Common Use Cases
- •Debugging OAuth2 / OpenID Connect access tokens and ID tokens.
- •Inspecting custom claim attributes during backend API development.
Related Developer Guides
How to Decode & Inspect JWT Tokens Safely
Comprehensive guide to JSON Web Tokens (JWT). Learn how to decode JWT headers and payloads, check token expiration (exp), inspect claim scopes, and verify signatures.
Read GuideBase64 Encoding Explained: How Binary-to-Text Encoding Works
Deep dive into Base64 encoding. Understand 6-bit binary translation, Base64 character index tables, padding with =, URL-safe Base64, and UTF-8 string encoding.
Read GuideFrequently Asked Questions
Does decoding a JWT verify its signature?
NO. Decoding extracts the payload for inspection but DOES NOT verify the secret key or public key signature.
Is my JWT sent to a remote server?
Never. Decoding is done 100% locally in your browser.