How to use JWT Decoder
- Paste a three-part token in header.payload.signature form.
- Read the formatted header and payload; any standard claim timestamps appear in UTC.
- Inspect or copy the decoded data while keeping the authenticity warning in mind.
A closer look
A typical signed JWT contains two Base64url-encoded JSON objects and a signature section separated by dots. Decoding reveals the objects but does not establish who created them or whether anyone changed them. This tool displays issuer (iss), subject (sub), audience (aud), and timestamp claims when present. Numeric exp, nbf, and iat values are interpreted as seconds since the Unix epoch. An empty signature can be displayed, but is never treated as proof of trust. Five-part encrypted tokens are outside this decoder’s scope.
A practical example
Paste a sample three-part token to inspect its header and payload. Reading an exp claim can help debugging, but does not prove the signature or issuer is valid.
A useful tip
Decoding a JWT does not verify its signature or authenticity. Successful parsing also does not check the expected issuer, audience, algorithm, or access permissions. Only the application’s proper verification process can make those decisions.
Good questions. Simple answers.
Does this show whether a token is valid?
No. It shows readable data and dates only. A fabricated token can contain convincing-looking claims.
Is the signature checked against a key?
No signing key is requested or used. The signature section is shown as Base64url text, explicitly unverified. All token processing remains local.
Explore all developer tools for related tasks and category-specific guidance, or read how Toolzafi handles your data.