About this tool
What it is, why it matters, and how to use it without common mistakes.
What is it?
A JWT decoder splits a JSON Web Token into header, payload, and signature segments and Base64URL-decodes the JSON claims for inspection.
Why use it?
Debugging auth failures usually starts with reading claims (exp, aud, sub) without calling the issuer. Decoding locally avoids pasting tokens into untrusted sites.
How it works
- Paste the compact JWT (header.payload.signature).
- Inspect header algorithm and payload claims.
- Check exp/nbf against the current time.
- Verify signatures in your backend — never trust a client-only decode for access control.
Examples
Typical claim set
{ "sub": "user_123", "aud": "api.example.com", "exp": 1735689600 }Best practices
- Treat JWTs as credentials — do not commit them or paste into public chats.
- Validate iss, aud, and signature server-side.
- Prefer short lifetimes and rotation for refresh tokens.
Common mistakes
- Accepting alg=none.
- Storing sensitive PII in the payload (it is only encoded, not encrypted).
- Using decode success as proof of authenticity.
FAQ
- Does decoding verify the signature?
- No. Decoding only reads the contents. Signature verification requires the issuer's key material on a trusted server.