JWT Decoder

How to use JWT Decoder

1. Paste a JWT sample with its three dot-separated segments.
2. Decode the header and payload locally.
3. Inspect claims such as alg, iss, aud, exp, and sub.
4. Do not treat decoded claims as trusted until the signature is verified elsewhere.

Common uses

• An API developer can inspect claim names in a synthetic token while debugging authorization wiring.
• A support engineer can convert an exp value to a date when investigating an expired-session report.

Example input

eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvZSJ9.

Example result

Header:
{
  "alg": "none",
  "typ": "JWT"
}
Payload:
{
  "sub": "user-123",
  "role": "reader",
  "exp": 2000000000
}

Common mistakes

• Assuming decoded claims are trustworthy. Fix: verify the signature, issuer, audience, algorithm, and time claims in the server security library.
• Reading exp as milliseconds. Fix: JWT NumericDate values use seconds since the Unix epoch.
• Pasting a live production token. Fix: use a synthetic, expired, or redacted token because bearer tokens are credentials.

Tips for reliable results

• Use an expired or redacted token for diagnostics whenever possible.
• Read exp, nbf, and iat as numeric dates and confirm whether the consuming system allows clock skew.
• Treat every decoded claim as untrusted until a separate signature and issuer validation succeeds.

Frequently asked questions