JWT Decoder
Decode JWT header and payload (no verification).
About the JWT Decoder
JSON Web Tokens (JWTs) have three Base64URL parts: header, payload, and signature. This decoder lets you inspect header and payload claims such as sub, exp, and roles while debugging auth issues.
How to use
- Paste the JWT string.
- Decode to view header and payload JSON.
- Check expiry (
exp) with a timestamp converter if needed. - Remember: decoding is not signature verification by itself.
Security warnings
- Never paste production refresh tokens into public tools if they are still valid and powerful.
- A decoded payload is readable to anyone with the token — do not put secrets in JWT claims.
- Verify signatures on the server with the correct key and algorithm.
FAQ
Why is my token “invalid” in an app but decodes here? Decoding can succeed while signature, audience, issuer, or expiry checks fail in the real verifier.