JWT Decoder
Inspect JWT header, payload and signature locally.
Decoded locally — signature not verified. Never trust a token’s claims until your server has verified the signature against its secret or public key.
About the JWT Decoder
Debugging an auth flow usually starts with one question: what is actually inside this token? Paste a JWT and the header and payload decode into pretty-printed JSON — algorithm, expiry, issuer, subject, custom claims — while the signature segment stays visible for comparison.
Decoding happens entirely in your browser: unlike pasting tokens into a hosted debugger, nothing here touches a server. That matters, because a live JWT is a credential. Note that decoding is not verifying — the signature is shown but not checked, so never trust the claims of a token your own server has not verified.
How to use it
- 1Copy the full token — three Base64URL segments joined by dots.
- 2Paste it into the input; header, payload and signature appear instantly.
- 3Check exp, iat and iss claims to debug expiry and audience issues.