JWT Decoder for Header, Payload, and Claims Viewer
Inspect JSON Web Token header, payload, and registered claims without treating the token as trusted.
Paste a JSON Web Token to inspect its Base64 URL decoded header and payload. Use the output for debugging and review only; this tool does not verify signatures, issuers, audiences, or token trust.
How it works
The tool displays the token header and payload as formatted JSON. Numeric iat, exp, and nbf values are also shown as UTC ISO dates when present.
The signature segment is not checked. A decoded token can still be expired, forged, from an unexpected issuer, sent to the wrong audience, or signed with an untrusted key. Use your application or identity provider to validate tokens before trusting them.
The decode step runs locally in the browser, but tokens can contain sensitive identifiers. Avoid pasting production bearer tokens unless you understand the risk.
