About the JWT Decoder
Inspect JWTs from OAuth, OpenID Connect and API authentication. The header and payload are decoded and pretty-printed; registered claims such as exp, iat and nbf are converted to readable dates, and you see at a glance whether the token has expired.
Tokens are decoded locally — never paste production tokens into tools that send them to a server.
How to use it
- Paste the token (with or without “Bearer ”).
- Read the header, payload and claims.
- Check the expiry status.
Good to know
- Decoding does not verify the signature. Anyone can create a token with any payload; only signature verification with the correct key proves authenticity.
- Encrypted tokens (JWE, five parts) cannot be decoded without the key.