JWT Decoder

How to use JWT Decoder

1. Paste a JWT sample with its three dot-separated segments.
2. Decode the header and payload locally.
3. Inspect claims such as alg, iss, aud, exp, and sub.
4. Do not treat decoded claims as trusted until the signature is verified elsewhere.

Common uses

• Inspect token claims during development
• Check expiration timestamps
• Review issuer and audience values

Example input

eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvZSJ9.

Example result

{
  "alg": "HS256"
}
{
  "sub": "123",
  "exp": 1893456000
}

Common mistakes

• Assuming decode verifies the signature
• Confusing seconds with milliseconds
• Sharing live production tokens

Tips for reliable results

• Use an expired or redacted token for diagnostics whenever possible.
• Read exp, nbf, and iat as numeric dates and confirm whether the consuming system allows clock skew.
• Treat every decoded claim as untrusted until a separate signature and issuer validation succeeds.

Frequently asked questions