What a JWT Decoder Can Tell You
A compact JWT normally has three dot-separated sections: header.payload.signature. The first two sections are Base64url-encoded JSON. This tool decodes those sections so you can inspect fields such as alg, typ, iss, sub, aud, exp, and application-specific claims.
A decoded token is not a verified token. Anyone can construct a header and payload, so readable claims must not be trusted until the signature is verified by the system that knows the expected key and algorithm.
Example Structure
A typical decoded header might contain {"alg":"HS256","typ":"JWT"}. A payload might contain {"sub":"123","exp":1893456000}. The exp value is a NumericDate measured in seconds since the Unix epoch; decoding shows the number but does not prove that the token is valid, unexpired, or intended for your application.
Use the Unix Timestamp converter when you need to inspect a timestamp claim, and use the Base64url tool when you are debugging the underlying URL-safe encoding.
Security Boundaries
- This page does not verify the JWT signature or key.
- It does not validate issuer, audience, nonce, scopes, or application authorization rules.
- Local browser processing avoids sending the token to this site, but bearer tokens can still be sensitive. Prefer synthetic or expired samples when possible.
- Do not change decoded JSON and assume the original signature remains valid; any signed-content change requires a new signature from the authorized issuer.