Understand What’s Inside a JWT Without Guesswork

JWTs are compact and convenient, but they’re not opaque. This decoder lets you see the header and payload exactly as your application will parse them—Base64URL decoded, formatted, and readable. It’s useful for debugging claims, testing middleware behavior, and validating that upstream systems are setting fields as expected.

Why Decode a JWT?

• Sanity‑check claims: Inspect iss, sub, aud, exp, and custom fields.
• Troubleshoot auth flows: Confirm what a gateway or identity provider actually issued.
• Developer onboarding: Teach teammates what each claim means in your system.

What This Tool Does (and Doesn’t)

• Decodes only: It does not verify signatures or check key material.
• Shows structure: Header, payload, and signature are displayed separately for clarity.
• Stays local: Decoding happens in your browser session.

Practical Tips

• If exp looks valid but the app still fails, confirm time skew and clock sync.
• Check aud and iss values match what your resource server expects.
• Use a separate tool (or your backend) when you need cryptographic verification.