Use a disposable token for inspection
The JWT Decoder exposes the JSON header and payload of a supported compact token. It expects three dot-separated Base64URL segments. It does not support encrypted five-segment tokens, and it does not contact your identity provider to obtain signing keys.
Decoding is useful when diagnosing the shape of claims returned by a development system. It cannot establish that those claims came from the stated issuer. Anyone can construct Base64URL text containing a chosen subject, role, or expiration value. The tool deliberately labels the signature NOT VERIFIED.
Decode a harmless example
Paste this intentionally unsigned demonstration value into JWT token:
eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0.After processing, the expected header contains "alg": "none", the payload contains "sub": "demo", and the signature field says NOT VERIFIED. The empty final segment is part of the example. This is an inspection exercise, not a token to accept in an authentication system.
If an entered token fails, check that it has exactly three segments and that its first two segments decode to object-shaped JSON. The decoder handles the URL-safe Base64 alphabet used here. A damaged token, a copied authorization prefix, or a token in another serialization format may require a different diagnostic approach.
Read timing claims carefully
Many JWTs include exp, nbf, and iat values. The JWT specification defines these using NumericDate values measured in seconds relative to the Unix epoch. Use Unix Timestamp Converter in Unix seconds mode to make an example claim readable.
This decoder does not check expiration, issuer, audience, allowed algorithms, or signature validity. An apparently future expiration date does not make a token authentic. Verification belongs in the application receiving the token, using its configured trust policy and a suitable maintained library.
Limit exposure during debugging
The maximum input is 250,000 characters, and decoding takes place in this browser. Nevertheless, a live token can be a sensitive credential. Prefer short-lived development tokens or a sample with personal claims removed. Avoid placing live tokens in screenshots, shared documents, or issue descriptions.
For an ordinary UTF-8 Base64 string that is not part of a token, use Base64 Encoder / Decoder. Keeping the format distinction clear helps avoid mistaking a readable payload for a successful security check.