JWT Decoder

What this JWT decoder does

This English-language JWT decoder splits any RFC 7519-compliant token into its three Base64URL-encoded parts — header, payload, and signature — and renders them as readable JSON. Standard claims like exp, iat, iss, sub, aud, nbf, and jti are highlighted automatically, and the tool tells you at a glance whether the token has already expired. One thing this tool deliberately does not do: verify the signature. Verification requires a secret or public key, and you should never paste either into a third-party website. Because decoding is pure Base64URL parsing, it is completely safe to inspect tokens that contain PII — no data is sent anywhere. This is 100% client-side — your data never leaves your browser. No uploads, no tracking, no server logs.

Features

• Instant Base64URL decode. Splits the token on the two dots and decodes each segment from Base64URL to JSON using the same logic as JSON.parse(atob(token.split('.')[1])) — no server round-trip needed.
• Standard claims inspector. Highlights iss, sub, aud, exp, iat, nbf, and jti in the payload so you can spot issuer or audience mismatches without hunting through raw JSON.
• Expiration status badge. Compares exp against the current local clock and shows a clear Expired or Not expired badge, useful when debugging stale access tokens from OAuth flows.
• Bearer prefix auto-strip. Accepts tokens pasted directly from an Authorization header — the Bearer prefix is stripped automatically so you don't have to clean the value first.
• Algorithm display. Shows the alg field from the header (HS256, RS256, ES256, and others) so you can quickly confirm whether the token was issued with the algorithm your service expects.
• One-click copy. Each decoded section has its own Copy button, making it easy to grab the payload JSON and paste it into a test fixture or a ticket without reformatting.

How to use the JWT decoder

Paste your token, and the decoder splits and formats everything in real time. No button to click — results appear as you type.

1. Copy the token. Grab the raw JWT from your browser's DevTools Network tab, from an Authorization header, or from your auth provider's dashboard. The full string including any Bearer prefix is fine.
2. Paste into the input. Drop it into the text area. The decoder splits the token on the two period characters and Base64URL-decodes each part immediately.
3. Read the payload. Inspect custom claims, check aud and iss against what your service expects, and confirm whether exp is in the future. In Python you can replicate this offline with jwt.decode(token, options={'verify_signature': False}).
4. Check expiration. The status badge tells you instantly if the token has passed its exp timestamp — a common cause of 401 errors in OAuth and OpenID Connect flows.
5. Copy individual sections. Use the Copy button next to Header, Payload, or Signature to extract exactly the JSON you need for a test case or a bug report.

Common use cases

• Debugging expired-token errors. When a service in New York returns a 401, paste the bearer token here to confirm whether exp has already passed before digging into logs. Saves minutes of guesswork.
• Inspecting issuer and audience mismatches. Multi-tenant SaaS applications often issue tokens scoped to a specific aud. Decode the access token to verify that iss and aud match what your middleware is configured to accept.
• Reading provider-specific custom claims. Auth0, Okta, Cognito, and similar platforms embed custom claims (roles, permissions, org IDs) in the payload. Decode the token to see exactly what claims are present before writing claim-mapping code.
• Pre-flight checks before integration tests. Validate token structure and algorithm before a test suite runs. Catching a misconfigured alg field at this stage — rather than inside a test assertion — cuts debugging time considerably.
• Security audits and code review. During a code review, quickly confirm that a sample token uses RS256 or ES256 rather than the weaker HS256, and that no sensitive fields are being embedded in the payload without encryption.

Frequently asked questions