JWT Token Decoder
Decode a JWT token into its header, payload and claims for inspection.
Inspecting a token's contents
A JSON Web Token carries its data in a payload of claims, encoded but not encrypted. This decodes the token into its three parts and lays out the claims — the issuer, the subject, the expiry, the permissions — so you can see exactly what a token asserts when you are debugging authentication or working out why a request is being rejected.
Paste the token and its header and payload are decoded.
Reading the standard claims
JWT payloads use a set of standard claim names worth recognising: the subject identifies who the token is about, the issuer who created it, the expiry and issued-at times bound its validity, and the audience who it is intended for, alongside whatever custom claims an application adds. Two constants for any JWT tool: decoding reveals what a token claims but does not verify it is genuine — only checking the signature with the key does that — and because the payload is readable by anyone, secrets must never be placed in it.
Common questions
What are the standard JWT claims?
Names like subject, issuer, expiry, issued-at and audience, alongside any custom claims the application adds.
Does decoding verify the token?
No — it reveals what the token claims. Only verifying the signature with the key proves it is genuine and unaltered.
Is my token uploaded?
No. It is decoded in your browser, which matters since tokens are sensitive.